Kerio Control and Kerio Connect: public exploits and updates you should not put off

The news: code to attack Kerio Control is now public

Between 6 and 9 October 2026, two ready-to-use exploits appeared on GitHub for Kerio Control, the GFI firewall widely used by small and medium-sized businesses across Europe (Vulners). They exploit three vulnerabilities known since summer 2025, with severity scores of up to 9.8 out of 10: chained together, they let an attacker take complete control of the firewall with the highest privileges.

Fixes have been available for more than a year. The problem is firewalls that were never updated: a device that "works" is often left untouched for years. As of this month, attacking them no longer takes an expert: downloading the code is enough.

Kerio is a concrete example of a broader issue. Firewalls, VPNs and mail servers sit on the network edge, and that is precisely why they are the first to be targeted.

Kerio Control: how the attack works

The vulnerabilities were discovered by an independent researcher and published by SSD Secure Disclosure in June 2025 (SSD). The weak point is GFIAgent, a service preinstalled since Kerio Control 9.4.3 to connect the firewall to the GFI AppManager cloud console.

In practice, the attacker only needs to be able to use the firewall's proxy. Anyone already inside the company network can do so, for example from a PC infected through an email attachment, or from outside if the proxy is reachable from the Internet: the researchers counted almost 300 exposed with a single public search. From there they reach the administration console without a password, and then take full control of the firewall.

What makes the case serious is persistence. A firewall running modified firmware can intercept traffic, open backdoors and survive reboots, without anyone noticing.

The fix is in Kerio Control 9.5 Patch 1 and later versions.

This is not the first time. In early 2025 another Kerio Control flaw, CVE-2024-52875, was actively exploited a few weeks after proof-of-concept code was published: an administrator clicking a link was enough to hand the firewall to the attacker (SecurityWeek). It had been in the product for about seven years.

Kerio Connect: mail that needs to stay up to date

Kerio Connect, the mail and calendar server from the same family, has no flaws this serious today, but it has received a series of security fixes that many servers have yet to install (GFI).

Two details deserve attention. In 2025 several cross-site scripting vulnerabilities were published for version 10.0.6, reported without a response from the vendor (OpenCVE): anyone still on versions from that period should update. And the same GFI agent that connects to AppManager is also present on Kerio Connect: the SSD researchers noticed that several Kerio Connect servers expose one of that service's ports to the Internet (SSD). It is worth checking that yours is not one of them.

Webmail is the most sensitive point: it is exposed to the Internet by definition and every employee uses it, including from outside the office.

Why firewalls and mail servers are the favourite target

In SMEs, the firewall and the mail server are often installed once and then forgotten. They work, nobody touches them, and updates are postponed to avoid interrupting the service. For an attacker they are ideal targets, for three reasons.

• They sit on the edge. They are reachable from the Internet by definition: whoever compromises them is already inside, without having to trick any user.
• They see everything. The firewall sees the whole company's traffic, the mail server every exchange with customers and suppliers. They are the perfect place to spy, steal credentials or set up an email fraud.
• Nobody monitors them. The antivirus that protects PCs does not run on a firewall or an appliance. A compromise can last for months without anyone noticing.

That is why criminals move very quickly on these devices: when a public exploit comes out, automated Internet-wide scans start within days. The 2025 Kerio case showed this clearly.

What to do if you use Kerio

Kerio Control

1. 01

   Check the version

   From the administration console: anything earlier than 9.5 Patch 1 must be updated immediately.

2. 02

   Before updating, save the configuration

   Make sure you have the licence login details.

3. 03

   Close the proxy to the outside

   Port 3128 must not be reachable from the Internet; internally too, restrict it to the networks that genuinely need it.

4. 04

   If you do not use GFI AppManager

   Assess with GFI support or whoever manages the firewall whether to disable the agent.

5. 05

   Update only with images downloaded from the official GFI website

   Never from files received by email or from third parties.

6. 06

   If the firewall went unpatched for a long time and was exposed

   Consider a clean reinstall with the saved configuration: modified firmware cannot be seen from the console.

Kerio Connect

1. 01

   Update to 10.0.9 Patch 2

   or later, after a full backup of the mail data.

2. 02

   Also update Kerio Outlook Connector

   on the PCs that use it.

3. 03

   Check the exposed ports

   Only the mail services and webmail need to be on the Internet; the administration console and the GFI agent ports must be closed or restricted.

4. 04

   Enable two-factor authentication

   for webmail and administrators.

For both: turn on new-version notifications and add the firewall and mail server to the monthly maintenance schedule, alongside the servers.

How we work

At Cloudfactory we manage firewalls and mail servers for companies and professional firms, including Kerio Connect servers, alongside Windows and Linux servers. We keep track of installed versions, read vendor bulletins and schedule updates at agreed times, with backups and a service check after the reboot.

If you use Kerio and are not sure which version you have, get in touch: we will check the version and exposure and tell you what to do.

How we wrote this article

At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.

Frequently asked questions

Sources

1. SSD Secure Disclosure, Kerio Control Authentication Bypass and RCE
2. Vulners, public exploit for Kerio Control (October 2026)
3. OpenCVE, Kerio Control vulnerabilities
4. GitHub Advisory, CVE-2025-34071
5. SecurityWeek, GFI KerioControl Firewall Vulnerability Exploited in the Wild
6. GFI, KerioConnect Product Releases
7. OpenCVE, CVE-2025-2975 (Kerio Connect 10.0.6)