External risk intelligence

Group-Office Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-63011

Group-Office is a groupware and customer relationship management (CRM) application. Such platforms are typically deployed as web-based enterprise services, often exposed to the network to facilitate access for remote employees, partners, or customers. The vulnerability exists within a JMAP endpoint, a protocol commonly used in web-based communication tools, which is frequently reachable in typical web-facing deployments of such software.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Group-Office, a tool used for customer relationship management and groupware. A flaw in its Contact/labels endpoint allows an authenticated attacker to execute arbitrary operating system commands by sending a single, crafted request. This could potentially lead to unauthorized access and control over the web server environment.

Enables unauthorized command execution on servers.
Critical for protecting customer and business data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Group-Office can exploit a flaw in the Contact/labels JMAP endpoint. By crafting a malicious template string in an HTTP request, they can trick the system into executing arbitrary operating system commands, effectively taking control of the web server.

Authenticated user access required.
Malicious template string triggers command execution.
Risk of arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user could execute arbitrary operating system commands as the web server user, potentially affecting system data and service behavior.

System data and service behavior at risk.
Arbitrary OS commands could be executed.
Unauthorized access and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in Group-Office. The first practical step is to identify all Group-Office instances, determine their network exposure and business criticality, and then confirm the accountable owner. Once identified, remediation can be planned based on the assessed risk, potentially involving vendor coordination or a planned maintenance window for patching.

Identify Group-Office instances and owners.
Verify external exposure and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Group-Office software?

Group-Office is a comprehensive enterprise platform designed to manage customer relationships and facilitate team collaboration through groupware features like calendars, email, and task management. It functions as a web-based service that businesses host to centralize organizational data and streamline communications between employees, partners, and clients.

What does CVE-2026-63011 mean for security?

This vulnerability is classified as Improper Control of Generation of Code or Code Injection. It occurs because the application improperly handles user-provided template strings, allowing an attacker to bypass security guards and force the server to execute unintended commands. It essentially turns a data-processing feature into a gateway for unauthorized system-level operations.

How is the command injection triggered?

An attacker triggers the vulnerability by sending a specific, maliciously crafted request to the Contact/labels JMAP endpoint. This request must include a crafted template string that leverages PHP's ability to interpret specific variable references as functions. It is important to note that unauthenticated users cannot trigger this; the exploit requires a successfully authenticated session to reach the vulnerable code path.

Is my Group-Office instance at risk?

If you host this software, you should treat it as potentially vulnerable if it is accessible over a network. According to Halo Surface Signal, Group-Office is typically deployed as a web-based service, making it a common target for remote access. If your installation is internet-facing to support remote staff or partners, it faces a higher likelihood of being reachable by an attacker with valid credentials.

How do I secure my environment against this?

Your first step is to verify the version of Group-Office you are running. If you are on a version older than 6.8.167, 25.0.102, or 26.0.27, you should prioritize upgrading to these patched releases immediately. Coordinate with your team to identify all active instances in your infrastructure and schedule a maintenance window to apply the vendor-provided updates, which remove the dangerous template processing behavior.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.