Is CVE-2026-63010 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63010 being exploited in the wild.

How severe is CVE-2026-63010?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Intermesh Group-Office prior to 6.8.172, 25.0.108, and 26.0.33.

Is there a fix for CVE-2026-63010?

Yes: fixed in 6.8.172, 25.0.108, 26.0.33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63010 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63010?

Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63010: Group-Office stored XSS in reminders via HTML/JavaScript injection

CVE-2026-63010 · Severity: info · Published 2026-11-10

Group-Office is an enterprise CRM and groupware platform used for customer relationship management and team collaboration. A low-privileged user can inject malicious code into reminders that executes when administrators or other users view notifications, allowing attackers to steal sessions and take over accounts. This affects organizations relying on Group-Office for business-critical communication and data management.

Technologies: Intermesh Group-Office. Vendors: Intermesh.

Quick answers

Is CVE-2026-63010 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63010 being exploited in the wild.
How severe is CVE-2026-63010?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Intermesh Group-Office prior to 6.8.172, 25.0.108, and 26.0.33.
Is there a fix for CVE-2026-63010?: Yes: fixed in 6.8.172, 25.0.108, 26.0.33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63010 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63010?: Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.8.172, 25.0.108, 26.0.33

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the reminder notification system where unsanitized HTML/JavaScript payloads are rendered directly as innerHTML in the ExtJS notification panel. An unauthenticated low-privileged user can create reminders containing arbitrary code and assign them to any user, including administrators. When the victim's browser polls for notifications, the payload executes in their security context, leading to session hijacking and full account compromise.

Affected products

Intermesh Group-Office prior to 6.8.172, 25.0.108, and 26.0.33

Timeline

2026-11-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.