GFI Software vulnerabilities
We track 3 vulnerabilities in GFI Software products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2025.
Latest GFI Software vulnerabilities
- 9.8 Critical severity
Kerio Control: Missing Authentication for Critical Functionality
A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modif
- 9.8 Critical severity
Kerio Control: Missing Authentication for Critical Functionality
A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services o
- 9.8 Critical severity
Kerio Control: Missing Authentication for Critical Functionality
An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to