Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-112356GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

Medium 6.1

In plain English

A medium-severity cross-site scripting in GFI KerioConnect from GFI USA, LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 83.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

Affected products (as reported)

Vendor	Product	Versions
GFI USA, LLC	GFI KerioConnect	0 – before 10.0.9p2

Weakness: CWE-79, CWE-83 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Release Notes release-notes, patch
VulnCheck Advisory: GFI KerioConnect < 10.0.9p2 HTML Injection via Link Auto-Formatter third-party-advisory