CVE-2026-63010: Group-Office: stored XSS via reminders enables ATO

HIGH

Published November 10, 2026

CISO Take

Group-Office, a groupware and CRM platform, has a stored cross-site scripting flaw. A low-privileged user can create a reminder containing arbitrary HTML/JavaScript and assign it to any other user, including administrators. The payload runs unsanitized in the victim's browser when it polls for notifications, which allows full session takeover. This is not an AI/ML product, and the 'ml_ui' tag looks like a misclassification, so the AI-specific exposure is limited to any AI tooling or data reachable through the compromised session. No CVSS score, EPSS score, KEV listing, public exploit or Nuclei template is available, so urgency rests on the ease of exploitation (low privilege, no victim interaction beyond normal polling) and the admin-takeover impact. Upgrade to 6.8.172, 25.0.108 or 26.0.33 and review reminders and notifications created by low-privileged accounts for script content.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Moderate to high for organizations running Group-Office, and low for AI/ML-specific risk. Exploitation needs only a low-privileged account and no special skills, and the victim does not have to click anything. Admin session takeover is the worst case. Severity and EPSS are not yet scored, there is no public exploit and no KEV listing, so there is no evidence of active exploitation. AI/ML exposure is indirect and applies only where the groupware holds credentials, documents or integrations that connect to AI systems.

How does the attack unfold?

Initial Access

A low-privileged user creates a manual reminder with a malicious HTML/JavaScript payload and assigns it to an administrator.

AML.T0049

Execution

The victim's browser polls for notifications and the ExtJS panel renders the payload unsanitized via innerHTML, running the script.

Credential Access

The script steals or abuses the victim's session, giving the attacker control of the account.

AML.T0012

Impact

The attacker takes over the administrator account and accesses or alters CRM and groupware data.

Initial Access

A low-privileged user creates a manual reminder with a malicious HTML/JavaScript payload and assigns it to an administrator.

AML.T0049

Execution

The victim's browser polls for notifications and the ExtJS panel renders the payload unsanitized via innerHTML, running the script.

Credential Access

The script steals or abuses the victim's session, giving the attacker control of the account.

AML.T0012

Impact

The attacker takes over the administrator account and accesses or alters CRM and groupware data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
groupoffice	—	—	No patch

Do you use groupoffice? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade Group-Office to 6.8.172, 25.0.108 or 26.0.33 or later. 2) Until patched, restrict who can create and assign reminders, and limit low-privileged account creation. 3) Search stored reminders and notifications for script tags, event handlers and javascript: URIs, and remove any you find. 4) Enforce a strict Content-Security-Policy that blocks inline scripts, and set HttpOnly and SameSite on session cookies. 5) If suspicious reminders are found, invalidate admin sessions, rotate credentials and API keys, and review audit logs for unexpected admin actions. 6) Watch web logs for requests from admin sessions that the admin did not initiate.

How is it classified?

Auth BypassSocial EngineeringFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-63010?

Is CVE-2026-63010 actively exploited?

No confirmed active exploitation of CVE-2026-63010 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-63010?

1) Upgrade Group-Office to 6.8.172, 25.0.108 or 26.0.33 or later. 2) Until patched, restrict who can create and assign reminders, and limit low-privileged account creation. 3) Search stored reminders and notifications for script tags, event handlers and javascript: URIs, and remove any you find. 4) Enforce a strict Content-Security-Policy that blocks inline scripts, and set HttpOnly and SameSite on session cookies. 5) If suspicious reminders are found, invalidate admin sessions, rotate credentials and API keys, and review audit logs for unexpected admin actions. 6) Watch web logs for requests from admin sessions that the admin did not initiate.

What systems are affected by CVE-2026-63010?

This vulnerability affects the following AI/ML architecture patterns: Web-based groupware/CRM front ends, Browser-based admin consoles.

What is the CVSS score for CVE-2026-63010?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Web-based groupware/CRM front endsBrowser-based admin consoles

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

What are the technical details?

Original Advisory

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.

Exploitation Scenario

An attacker with a low-privileged Group-Office account creates a manual reminder whose body contains an HTML payload with embedded JavaScript, and assigns it to an administrator. When the administrator's browser polls for pending notifications, the ExtJS notification panel renders the payload through innerHTML and the script runs in the admin's session. The script exfiltrates the session token or performs admin actions such as creating a backdoor account or reading shared data. The attacker then uses that access to reach any connected systems, which could include AI or data-science resources whose credentials are stored in the groupware.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PagePrimary CWE-79Improper Neutralization of Input During Web Page Generation CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.