Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-112357GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

High 7.8

In plain English

A high-severity incorrect default permissions in GFI KerioConnect from GFI USA, LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.

Affected products (as reported)

Vendor	Product	Versions
GFI USA, LLC	GFI KerioConnect	0 – before 10.0.9p2

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes, patch
VulnCheck Advisory: GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation third-party-advisory