Overview

Kerio Connect 10.0.9 p2 (build 10320) has been released and is available for download:

• Release date: 2026-06-29
• Build ID: 10320

Changes in this release

Security fixes

• Closed a Webmail vulnerability where nested anchor <a> tags could be injected when rendering HREF links.
• Removed the obsolete legacy “nano” Webmail interface, eliminating an unmaintained surface and its associated exposure.
• Strengthened the file-system permissions on the Kerio Outlook Connector Offline Edition installer folders to close a local privilege-escalation issue.

Bug fixes

• Fixed inbound delivery of duplicate messages, seen with Gmail senders when Spam Repellent greeting delay is enabled. Inbound de-duplication of repeated messages is now enabled by default.
• Fixed large-body messages not being scanned by the spam filter. The spam-filter message size limit has been raised from 1 MB to 8 MB.
• Fixed calendar synchronization for the VMware Boxer app on iPhone and Android devices.
• Fixed renewed Kerio Connect license activation failing with “unable to load new license file” via both registration update and license.key import, including on fresh installs.
• Fixed the Spam log view displaying thousands of garbage rows after clearing the log once log rotation had occurred. The view now empties correctly without requiring a service restart.
• Fixed the Agent log being impossible to clear from WebAdmin after integrating Kerio Connect with GFI AppManager.
• Fixed the Kerio Outlook Connector Offline Edition default signature not being retained after saving on recent Outlook builds.
• Fixed a crash when an ActiveSync client sent a malformed calendar location. Out-of-range coordinates are now handled gracefully.
• Fixed the two-factor-authentication cookie verification message being logged at error level instead of debug.