GFI KerioConnect up to 10.0.9p1 Outlook Connector searchd.exe privileges management

Summaryinfo

A vulnerability was found in GFI KerioConnect up to 10.0.9p1. It has been classified as very critical. This vulnerability affects unknown code of the file searchd.exe of the component Outlook Connector. Performing a manipulation results in privileges management. This vulnerability was named CVE-2026-112357. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical has been found in GFI KerioConnect up to 10.0.9p1. This affects an unknown code block of the file searchd.exe of the component Outlook Connector. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.

The advisory is shared at gfi.ai. This vulnerability is uniquely identified as CVE-2026-112357 since 10/19/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/28/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 10.0.9 Patch 2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• GFI

Name

• KerioConnect

Version

• 10.0.9p1

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion