CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112356?
CVE-2026-112356 is a medium-severity vulnerability in GFI KerioConnect, published on 28 Oct 2026.
Official description
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
Which versions are affected by CVE-2026-112356?
How do I fix CVE-2026-112356?
No fix has been published for CVE-2026-112356 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112356 being exploited?
There is no known exploitation of CVE-2026-112356 in the wild and no public exploit code.
Sources
Also known as GHSA-53x6-q8p5-wm6r.