SOGo webmail XSS-to-RCE flaw exploited in wild
An actively exploited XSS bug in Alinto SOGo lets attackers hijack mailboxes via malicious SVG payloads embedded in calendar invites.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed CVE-2026-8496, a cross-site scripting vulnerability in Alinto SOGo v5.12.7 that stems from insufficient sanitization of the DESCRIPTION field in ICS calendar invitations. Attackers can embed SVG objects containing JavaScript event handlers (e.g., <animate onrepeat='...'>) that execute automatically when a victim views or previews the calendar tab in SOGo's webmail interface, requiring no further interaction beyond opening the calendar view.
Successful exploitation grants the attacker full read access to the victim's mailbox, enabling credential theft via forced logout/login phishing, password manager autofill hijacking, and exfiltration of emails, contacts, and calendar metadata. VirusTotal sightings confirm this vulnerability has already been exploited in the wild, making it an active threat to any organization running vulnerable SOGo instances rather than a theoretical risk. SOGo is commonly deployed by organizations as a self-hosted groupware layer atop existing mail infrastructure, meaning exposure spans a broad range of self-hosting enterprises.
The vendor has patched the issue in SOGo v5.12.8, which sanitizes ICS DESCRIPTION content and enforces stricter handling of embedded SVG and HTML. Organizations running SOGo should prioritize upgrading given confirmed real-world exploitation and the low interaction bar (a mere calendar preview) required to trigger the payload.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/487613
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs