# CVE-2026-112357: GFI KerioConnect Outlook Connector privilege escalation via installer permissions

Source: https://junglewise.ai/threats/cve-2026-112357-gfi-kerioconnect-kerio-connect-outlook-connector-offline-edition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-112357 · Severity: high · CVSS 7.8 · Published 2026-10-28

GFI KerioConnect's Outlook Connector (Offline Edition, KOFF) is a desktop application that synchronizes email and calendar data between Outlook and the mail server. A local attacker who has non-administrative access to a Windows workstation can exploit weak installer permissions to replace a service binary and gain system-level privileges, allowing them to take complete control of the affected machine and its data.

Vendors: [GFI](https://junglewise.ai/threats/vendors/gfi).

## Quick answers

**Is CVE-2026-112357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112357 being exploited in the wild.

**How severe is CVE-2026-112357?** High severity, with a CVSS score of 7.8, published 28 October 2026.

**Which products and versions are affected?** GFI KerioConnect Outlook Connector (Offline Edition) before 10.0.9 Patch 2.

**Is there a fix for CVE-2026-112357?** Yes: fixed in 10.0.9 Patch 2. Until then: Strengthen file-system permissions on the KOFF installation directory to prevent write access by non-administrative users. Restrict local user logon privileges on systems running KOFF to trusted accounts only.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-28"
  },
  {
    "kind": "patched",
    "at": "2026-06-29",
    "note": "Fix released in version 10.0.9 Patch 2"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112357 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-112357?** Check whether you run GFI KerioConnect Outlook Connector (Offline Edition) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.9 Patch 2

Strengthen file-system permissions on the KOFF installation directory to prevent write access by non-administrative users. Restrict local user logon privileges on systems running KOFF to trusted accounts only.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-28"
  },
  {
    "kind": "patched",
    "at": "2026-06-29",
    "note": "Fix released in version 10.0.9 Patch 2"
  }
]

## Technical details

A local privilege escalation vulnerability exists in KOFF versions before 10.0.9 Patch 2, caused by the installer setting overly permissive NTFS permissions on the product directory, making it writable by the built-in Users group. An unauthenticated local attacker can replace the searchd.exe binary used by KOFFIndexingService, which runs as LocalSystem, and execute arbitrary code with NT AUTHORITY\SYSTEM privileges on service restart or reboot. The vulnerability requires local file system access but no user interaction or administrative privileges to exploit.

## Affected products

- GFI KerioConnect Outlook Connector (Offline Edition) before 10.0.9 Patch 2

## References

- [https://gfi.ai/resource/kerioconnect-product-releases/](https://gfi.ai/resource/kerioconnect-product-releases/)
- [https://www.vulncheck.com/advisories/gfi-kerioconnect-koff-9p2-privilege-escalation](https://www.vulncheck.com/advisories/gfi-kerioconnect-koff-9p2-privilege-escalation)