An attacker who knows your email address can read your mail. That is the practical effect of a flaw in SOGo, an open-source webmail and groupware platform, that is being exploited in the wild: the attacker sends an ordinary calendar invitation, and when the target opens their calendar, hidden script runs inside their logged-in webmail session and starts handing over the mailbox.
The CERT Coordination Center at Carnegie Mellon published a vulnerability note on the flaw on August 6, tracked as CVE-2026-8496. CERT/CC states plainly that it "has been actively exploited in the wild, as confirmed by VirusTotal sightings", and credits Greg Lesnewich with reporting it. CERT/CC also discloses that the note itself was AI-assisted, which is why the account below is cross-checked against the vendor's own release and the upstream code fix.
Who is using it
The exploitation is not anonymous. In research published on July 23 by Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly and the Proofpoint Threat Research Team, Proofpoint says it discovered an espionage actor it tracks as TA458 exploiting the SOGo flaw as a zero-day in March 2026, and reported it to the vendor, Alinto, which patched it as CVE-2026-8496 in version 5.12.8. Proofpoint assesses that TA458 is likely a Russian military intelligence operation directed by the GRU.
Proofpoint describes TA458's targets as primarily Ukrainian government bodies and Eastern European military and government entities in Albania, Greece, Moldova and Turkey, with occasional targeting of chemical, telecommunications and technology firms. Against these mail servers the group deploys SpyPress, an obfuscated JavaScript malware it adapts to whichever webmail product it is attacking; the SOGo variant stole credentials, contacts and emails.
Proofpoint calls these "half-click" exploits, meaning, in its words, that the attack "requires no social engineering, nor does it require a user to click a link or open an attachment". CERT/CC's description matches: the script fires "during normal calendar view rendering", even without explicit interaction. You do not have to accept the invitation. You only have to look at your calendar.
How it works
The problem is in how SOGo renders ICS calendar files. Per CERT/CC, the DESCRIPTION field of an invitation is displayed "without proper sanitization or Content Security Policy (CSP) enforcement", so an SVG object carrying a JavaScript event handler, such as an animation element with an onrepeat handler, executes in the browser in the SOGo context. Because it runs inside an authenticated session, it inherits whatever the logged-in user can do. CERT/CC lists the consequences as read access to the victim's mailbox, credential theft through forced logout and login phishing, hijacking of password manager autofill, and exfiltration of messages, contacts and calendar data.
One caution on severity: CERT/CC's overview uses the phrase "remote code execution", but what is described, and what the NVD entry supports, is JavaScript execution inside the webmail session. NVD carries a CVSS 3.1 base score of 6.1, rated medium, contributed by CISA's ADP rather than by CERT/CC, which publishes no score of its own.
What you should do
Upgrade to SOGo 5.12.8 or later. Everything up to and including 5.12.7 is affected, and CERT/CC offers no workaround for operators who cannot patch.
The uncomfortable part is the timeline. Version 5.12.8 shipped on May 12, so the fix has been available for nearly three months, but the release notes only mention "2 possible XSS injections with malicious mail: fixed" and never name this CVE or describe the calendar-invite path. Administrators reading those notes had little way to know they were being handed a fix for a flaw a state-linked group was already using. CERT/CC records the vendor status as unknown and says it received no statement, though in fairness Alinto had already shipped the fix two weeks before CERT/CC notified it. No network indicators, addresses or file hashes have been published for this activity, so version auditing is the practical detection: anything running 5.12.7 or earlier should be treated as exposed since at least May.
IntelFusions covered a separate Russian webmail espionage campaign against Zimbra in July. That is a different actor, product and vulnerability, but the pattern is the same one defenders keep meeting: self-hosted webmail is where email espionage is being done, and the exploit arrives as a message the victim never has to act on.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.