GFI KerioConnect KOFF: Local privilege escalation to SYSTEM via weak installer permissions

Summary

The Kerio Outlook Connector (Offline Edition), KOFF, of GFI KerioConnect before 10.0.9 Patch 2 installs with weak directory permissions that allow the built-in Users group to write to the product directory. A local user without administrative rights can replace the searchd.exe service binary of KOFFIndexingService, which runs as LocalSystem, and execute arbitrary code with SYSTEM privileges after the next service start or reboot. The attacker needs a local account on a Windows machine with KOFF installed; the issue is not remotely exploitable.

Affected

• GFI KerioConnect KOFF (Outlook Connector Offline Edition) versions before 10.0.9 Patch 2
• Affected range per CVE record: 0 to before 10.0.9p2

Fixed in

• Upgrade to GFI KerioConnect 10.0.9 Patch 2 (build 10320, released June 29, 2026), which strengthens the file-system permissions of the KOFF installer folders
• Note: the release notes do not name the CVE explicitly; the mapping is taken from the CVE record and aggregator summaries

Workaround

• Remove write access for ordinary users (Users group) on the KOFF installation directory; test first, as this may affect the KOFF service
• Until patched, restrict local logon on affected machines where possible

Exploitation

• No public proof-of-concept or exploit found by VulDB and OffSeq; OffSeq reports no known exploitation
• One unverified threat-intel feed entry lists the CVE as confirmed exploited; this has not been verified and is not in CISA KEV in the sources reviewed
• EPSS at time of analysis: 0.13 % (percentile 2)

Our recommendation

• Identify Windows systems with the Kerio Outlook Connector (Offline Edition) installed, especially shared PCs, terminal servers and RDS hosts
• Update the KOFF client on each affected machine to 10.0.9 Patch 2 or later; the fix is in the client installer, so the server update alone is not sufficient
• Until patched, remove write permissions for the Users group on the KOFF directory and monitor for unexpected changes to searchd.exe
• Verify the exploitation entry at the CIRCL Vulnerability-Lookup source before raising priority; patch within the normal cycle otherwise

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GFI KerioConnect Product Releases gfi.ai
• VulnCheck Advisory: GFI KerioConnect KOFF < 10.0.9p2 www.vulncheck.com
• VulDB entry 428013 vuldb.com
• Kerio Connect 10.0.9 p2 Release Notes support.kerioconnect.gfi.com
• OffSeq Radar: CVE-2026-112357 radar.offseq.com
• CVE-2026-112357 at cve.threatint.com cve.threatint.com
• Strix: CVE-2026-112357 www.strix.ai
• GitHub threat-intel digest 2026-10-30 (unverified entry) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:53.