CVE-2026-112357: GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GFI KerioConnect KOFFto a version that resolves this vulnerability.Fixed in 10.0.9 Patch 2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running GFI Kerio Connect Outlook Connector (Offline Edition) KOFF before 10.0.9 Patch 2 are exposed if the product directory is writable by the built-in Users group. Exploitation requires local access by a non-administrative user.
What does an attacker need to do to gain SYSTEM privileges?
A local non-administrative attacker must replace the searchd.exe binary used by KOFFIndexingService. When that LocalSystem service next starts, or after a reboot, the replacement can execute with NT AUTHORITY\SYSTEM privileges.
How can administrators check whether a system is affected?
Verify the installed KOFF version and whether it is before 10.0.9 Patch 2. Also inspect permissions on the KOFF product directory and determine whether the built-in Users group can modify searchd.exe or its containing directory.
What can be done if patching is not immediately possible?
Remove write permissions for the built-in Users group from the KOFF product directory and protect the searchd.exe service binary from modification. Review the binary for unauthorized replacement, especially before restarting the KOFFIndexingService or rebooting the system.