CVE-2026-8496

Vulnerability intelligence

Published May 13, 2026Sources checked Oct 28, 2026

6.1MEDIUMCVSS out of 10

What this means

Exploitation reported: act now

CERT/CC Vulnerability Notes reports exploitation in the wild. This is separate from CISA KEV membership.

Public exploit: Not collected.

CERT/CC Vulnerability Notes: Exploitation reported by CERT/CC Vulnerability Notes (2026-08-06)
CERT/CC reports exploitation of SOGo CVE-2026-8496, citing observed malicious calendar invitations. The affected browser context can expose mailbox data.

What to do next

Remediation and response

Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2026-8496?

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session.

The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed.

Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.

Source: NVD

Reported activity: CERT/CC reports exploitation of SOGo CVE-2026-8496, citing observed malicious calendar invitations. The affected browser context can expose mailbox data.
CERT/CC Vulnerability Notes · Published Aug 6, 2026