Attackers exploit Kerio Connect flaw to steal mailboxes

Attackers have exploited CVE-2026-112353, a stored cross-site scripting (XSS) flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. The CVE record notes exploitation in the wild as a credential and mailbox stealer, with a CVSS v3.1 score of 8.2 and CVSS v4 score of 6.2, according to VulnCheck.

The form of attack involves a crafted SVG email attachment that runs JavaScript within a victim’s Webmail session, bypassing sanitisation of event-handler attributes, and a temporary-download endpoint with an insufficient Content-Security-Policy sandbox. Proofpoint Threat Research is cited as having observed real-world exploitation.

All GFI KerioConnect versions prior to 10.0.8 Patch 2 are affected, with the vulnerability being fixed in KerioConnect 10.0.8 Patch 2, released on 28 November 2025. GFI’s release notes state that the Webmail cross-site scripting vulnerability was addressed and that script execution is now disabled for downloaded content. The advisory notes that active exploitation was underway before the patch and that unpatched servers remain at risk.

The article credits Proofpoint researchers Stu Del Caliz and Greg Lesnewich with finding the flaw. Practically, admins are urged to update to 10.0.8p2 and to warn users about unexpected SVG attachments, while reviewing Webmail sessions for signs of credential theft. The report also notes that this Kerio Connect vulnerability is not yet listed in CISA KEV. The piece references EPSS and CVSS metrics and provides the action to update to 10.0.8p2.