TL;DR Attackers have exploited CVE-2026-112353, a stored XSS flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. According to the CVE record published by VulnCheck, "Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer." This Kerio Connect vulnerability scores 8.2 on CVSS v3.1 and 6.2 on CVSS v4. A crafted SVG email attachment can run JavaScript in a victim's Webmail session.

TL;DR Attackers have exploited CVE-2026-112353, a stored XSS flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. According to the CVE record published by VulnCheck, "Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer." This Kerio Connect vulnerability scores 8.2 on CVSS v3.1 and 6.2 on CVSS v4. A crafted SVG email attachment can run JavaScript in a victim's Webmail session.