Roundcube flaws being used in attacks

CISA lists 11 flaws in Roundcube products as being used in attacks, most recently on 20 Feb 2026.

What to do

1. Update every Roundcube product you use.Install the updates Roundcube offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 20 Feb 2026
   Roundcube Webmail
   CVE-2025-68461RoundCube Webmail Cross-site Scripting Vulnerability
   RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 20 Feb 2026
   Roundcube Webmail
   CVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data Vulnerability
   RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 9 Jun 2025
   Roundcube Webmail
   CVE-2024-42009RoundCube Webmail Cross-Site Scripting Vulnerability
   RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 24 Oct 2024
   Roundcube Webmail
   CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
   RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 26 Jun 2024
   Roundcube Webmail
   CVE-2020-13965Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
   Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 12 Feb 2024
   Roundcube Webmail
   CVE-2023-43770Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
   Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
7. Being used in attacksAdded by CISA on 26 Oct 2023
   Roundcube Webmail
   CVE-2023-5631Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
   Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 22 Jun 2023
   Roundcube Webmail
   CVE-2021-44026Roundcube Webmail SQL Injection Vulnerability
   Roundcube Webmail is vulnerable to SQL injection via search or search_params.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
9. Being used in attacksAdded by CISA on 22 Jun 2023
   Roundcube Webmail
   CVE-2020-35730Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
   Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
10. Being used in attacksAdded by CISA on 22 Jun 2023
    Roundcube Webmail
    CVE-2020-12641Roundcube Webmail Remote Code Execution Vulnerability
    Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
11. Being used in attacksAdded by CISA on 3 Nov 2021
    Roundcube Webmail
    CVE-2017-16651Roundcube Webmail File Disclosure Vulnerability
    Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Roundcube on CISA’s site.