Is CVE-2026-8496 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8496 being exploited in the wild.

How severe is CVE-2026-8496?

Medium severity, with a CVSS score of 6.1, published 13 May 2026.

Which products and versions are affected?

Alinto Sogo 5.12.7 and all versions prior to 5.12.8.

Is there a fix for CVE-2026-8496?

A patch was published on 2026-05-08: Fix available in nightly builds Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8496 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-8496?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8496: A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar…

CVE-2026-8496 · Severity: medium · CVSS 6.1 · Published 2026-05-13

Alinto SOGo is an open-source collaborative software server used for email, calendaring, and contacts. A security vulnerability in the way it handles calendar invitations allows an attacker to execute malicious code in a user's browser when they view a specially crafted invite. This could lead to unauthorized access to the user's mailbox, theft of sensitive emails and contacts, or the hijacking of their active session.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-8496 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8496 being exploited in the wild.
How severe is CVE-2026-8496?: Medium severity, with a CVSS score of 6.1, published 13 May 2026.
Which products and versions are affected?: Alinto Sogo 5.12.7 and all versions prior to 5.12.8.
Is there a fix for CVE-2026-8496?: A patch was published on 2026-05-08: Fix available in nightly builds Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8496 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-8496?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Alinto SOGo version 5.12.7 and earlier. The issue resides in the UIxMailPartICalViewer component, which fails to sufficiently sanitize SVG content embedded within the description field of ICS (calendar) files. Specifically, the application does not properly filter 'onrepeat' event handlers within SVG tags. An unauthenticated remote attacker can exploit this by sending a malicious calendar invitation to a victim; when the victim views the invitation in the SOGo webmail interface, the embedded JavaScript executes in the context of their session. This can result in session hijacking, data exfiltration, or unauthorized actions performed on behalf of the user. The vulnerability is addressed in version 5.12.8.

Affected products

Alinto SOGo 5.12.7 and all versions prior to 5.12.8

Timeline

2026-05-08: patched: Fix available in nightly builds
2026-05-12: advisory: Vendor release announcement for SOGo v5.12.8
2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.