Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-13 | 1 | Disclosure1 |
| 2026-08-06 | 1 | Active Exploitation1 |
| 2026-09-18 | 1 | Patch1 |
| 2026-09-20 | 1 | Patch1 |
【注意】SOGoのICS招待にXSS脆弱性、5.12.8へ更新を https://www.cybernote.click/2026/09/13/alinto-sogo-cve-2026-8496-ics-xss/ #IT #Security #cybersecurity
Post summary
The text announces a XSS vulnerability (CVE-2026-8496) in SOGo's ICS invitations and recommends updating to version 5.12.8 to remediate the issue. No PoC, exploit tool, or active exploitation claims are made.
【注意】SOGoのICS招待にXSS脆弱性、5.12.8へ更新を https://www.cybernote.click/2026/09/13/alinto-sogo-cve-2026-8496-ics-xss/ #IT #Security #cybersecurity
Post summary
The tweet announces an XSS vulnerability in SOGo and references an update to version 5.12.8 as remediation, indicating a patch is available. No active exploitation or PoC code is mentioned.
CVE-2026-8496 is a live XSS in Alinto SOGo v5.12.7: malformed ICS calendar invites render SVG with JavaScript in the DESCRIPTION field, with no sanitization or CSP, and trigger on normal calendar view > one malformed ICS invite can execute JavaScript in SOGo v5.12.7's calendar view, giving attackers full read access to victims' mailboxes; v5.12.8 fixes it > attackers are already exploiting a live XSS vulnerability in Alinto SOGo v5.12.7, CVE-2026-8496, delivered through malformed ICS calendar invitations, and CERT/CC's > patch is already out: upgrade to Alinto SOGo v5.12.8 or newer > v5.12.8 sanitizes ICS DESCRIPTION content and tightens handling of embedded SVG and HTML > public disclosure and first publication both landed on 2026-08-06, so this is not a dormant bug report > its calendar module renders ICS DESCRIPTION fields without sanitization or Content Security Policy enforcement, which turns a crafted calendar invite into a script https://news.ojobit.com/story/actively-exploited-sogo-xss-ics-mailbox-theft-0fe0da
Post summary
CVE-2026-8496 is a live XSS flaw in Alinto SOGo v5.12.7 that is currently being exploited via malformed calendar invites, with a fix released in v5.12.8.
CVE-2026-8496 Cross-Site Scripting Vulnerability in Alinto SOGo 5.12.7 ICS Calendar Invitations https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8496
Post summary
The text announces CVE‑2026‑8496 as a cross‑site scripting error in Alinto SOGo 5.12.7, providing only a reference link without additional exploit or mitigation details.