{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-112353/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gfi:kerioconnect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-112353"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["KerioConnect (\u003c 10.0.8 Patch 2)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-112353","xss","webmail","data-theft"],"_cs_type":"threat","_cs_vendors":["GFI"],"content_html":"\u003cp\u003eGFI KerioConnect (Kerio Connect) versions prior to 10.0.8 Patch 2 contain a stored cross-site scripting (XSS) vulnerability within the Webmail component. The vulnerability arises from insufficient sanitization of event-handler attributes in SVG email attachments. Exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated victim's session. Proofpoint Threat Research has confirmed in-the-wild exploitation of this vulnerability for credential and mailbox data theft.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious SVG file containing JavaScript within event-handler attributes.\u003c/li\u003e\n\u003cli\u003eAttacker sends the crafted SVG file as an email attachment to a targeted user.\u003c/li\u003e\n\u003cli\u003eVictim accesses their account via the vulnerable KerioConnect Webmail interface.\u003c/li\u003e\n\u003cli\u003eVictim interacts with or triggers a preview of the malicious email attachment.\u003c/li\u003e\n\u003cli\u003eThe KerioConnect temporary-download endpoint serves the SVG content.\u003c/li\u003e\n\u003cli\u003eDue to an insufficient Content-Security-Policy (CSP) sandbox, the embedded JavaScript executes in the victim's browser session.\u003c/li\u003e\n\u003cli\u003eMalicious scripts exfiltrate user credentials or mailbox contents to an attacker-controlled server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed exploitation results in unauthorized credential theft and access to mailbox contents for authenticated users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade all GFI KerioConnect installations to version 10.0.8 Patch 2 or later immediately.\u003c/p\u003e\n","date_modified":"2026-10-27T18:02:25Z","date_published":"2026-10-27T18:02:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gfi-kerioconnect-xss/","summary":"GFI KerioConnect versions before 10.0.8 Patch 2 are susceptible to stored XSS via maliciously crafted SVG attachments, allowing attackers to execute arbitrary JavaScript in authenticated user sessions.","title":"GFI KerioConnect: Stored Cross-Site Scripting in Webmail (CVE-2026-112353)","url":"https://feed.craftedsignal.io/briefs/2026-10-gfi-kerioconnect-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-112353","version":"https://jsonfeed.org/version/1.1"}