{"id":"roundcube-webmail-exploited-flaws-feb-2026","category":"patch","status":"closed","title":"Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available","tldr":"Two patched Roundcube Webmail flaws are being exploited: one lets logged-in attackers run code on the server; the other runs scripts in users’ browsers. Ask your email provider or IT team to confirm its server is updated and checked for compromise.","summary":"These flaws affect Roundcube Webmail, the browser-based email software run by hosting providers and organisations. CVE-2025-49113 lets an attacker with a valid login run code on the server; Roundcube fixed it in 1.5.10 and 1.6.11 in June 2025. CVE-2025-68461 lets malicious SVG content run scripts in a user’s browser session; it was fixed in 1.5.12 and 1.6.12 in December 2025. Those December releases contain both fixes. CISA listed both as exploited on 20 February 2026. In July, Proofpoint described attacks using the server flaw against university departments from May and said identified victims were being notified. That campaign used a different browser flaw, not CVE-2025-68461. As at 3 November, fixes remain available; the reviewed sources do not establish that attacks have ended. Roundcube’s notices give no severity ratings. MITRE’s CVE records score the flaws 9.9 and 7.2 respectively, while NVD scores them 8.8 and 6.1.","action":"If your email uses Roundcube, ask your email provider or IT team to install the latest supported release and confirm it includes both fixes, first combined in 1.5.12 and 1.6.12. Ask them to check the server for compromise as well as updating it; this is a server update they must handle.","product":"Roundcube Webmail","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-49113","CVE-2025-68461"],"tags":["roundcube","webmail","email","remote-code-execution","cross-site-scripting","actively-exploited"],"affected":["CVE-2025-49113: Roundcube Webmail before 1.5.10; 1.6.x before 1.6.11","CVE-2025-68461: Roundcube Webmail before 1.5.12; 1.6.x before 1.6.12"],"fixed":["CVE-2025-49113: Roundcube Webmail 1.5.10 and 1.6.11","CVE-2025-68461: Roundcube Webmail 1.5.12 and 1.6.12"],"matches":[],"sources":[{"kind":"advisory","title":"Security updates 1.6.11 and 1.5.10 released","url":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10","by":"Roundcube","date":"2025-06-01"},{"kind":"advisory","title":"Security updates 1.6.12 and 1.5.12 released","url":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","by":"Roundcube","date":"2025-12-13"},{"kind":"advisory","title":"CVE-2025-49113: CVE record and mirrored CISA/NVD data","url":"https://cve.circl.lu/vuln/cve-2025-49113","by":"CIRCL Vulnerability-Lookup","date":"2026-02-21"},{"kind":"advisory","title":"CVE-2025-68461: CVE record and mirrored CISA/NVD data","url":"https://cve.circl.lu/vuln/CVE-2025-68461","by":"CIRCL Vulnerability-Lookup","date":"2026-02-26"},{"kind":"news","title":"CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog","url":"https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html","by":"The Hacker News","date":"2026-02-21"},{"kind":"news","title":"Hackers target vulnerabilities in Roundcube Webmail","url":"https://www.cybersecuritydive.com/news/hackers-target-vulnerabilities-in-roundcube-webmail/812839/","by":"Cybersecurity Dive","date":"2026-02-23"},{"kind":"research","title":"One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation","url":"https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation","by":"Proofpoint","date":"2026-07-07"},{"kind":"advisory","title":"AL25-007: Vulnerability impacting Roundcube Webmail – CVE-2025-49113 – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/vulnerability-impacting-roundcube-webmail-cve-2025-49113","by":"Canadian Centre for Cyber Security","date":"2026-07-10"}],"started":"2026-02-20","closed":"2026-07-10","created":"2026-11-03T22:26:20.544Z","updated":"2026-11-03T22:26:20.544Z","cve_notes":[{"cve":"CVE-2025-49113","name":"Authenticated code execution in Roundcube Webmail","what":"Unsafe handling of serialised PHP objects in Roundcube’s settings-upload processing lets an attacker with a valid login run code on the webmail server.","severity":"unknown","cvss":9.9},{"cve":"CVE-2025-68461","name":"SVG cross-site scripting in Roundcube Webmail","what":"A flaw in Roundcube’s handling of SVG animation content lets an attacker run scripts in a webmail user’s browser session and act with that user’s access.","severity":"unknown","cvss":7.2}],"timeline":[{"at":"2026-07-10","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"Canada’s Cyber Centre updated its alert to highlight reported ongoing exploitation of CVE-2025-49113. It urged organisations to update Roundcube and monitor for signs of compromise.","url":"https://www.cyber.gc.ca/en/alerts-advisories/vulnerability-impacting-roundcube-webmail-cve-2025-49113","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-07-07","added":"2026-11-03T22:23:55.101Z","kind":"wider-attacks","text":"Proofpoint reported attacks observed since May against physics and engineering departments at US and Canadian universities, using CVE-2025-49113 after a separate, older browser scripting flaw. Attackers stole credentials and installed backdoors; Proofpoint coordinated notification of identified victims.","url":"https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation","by":"Proofpoint","patch":null},{"at":"2026-02-20","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added both flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in attacks. US federal civilian agencies were given until 13 March to address them.","url":"https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html","by":"The Hacker News","patch":null},{"at":"2025-12-13","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Roundcube released 1.5.12 and 1.6.12 to fix the SVG cross-site scripting flaw CVE-2025-68461. These versions include fixes for both flaws in this record.","url":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","by":"Roundcube","patch":"patched"},{"at":"2025-06-01","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Roundcube released 1.5.10 and 1.6.11 to fix the authenticated server code-execution flaw later identified as CVE-2025-49113.","url":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10","by":"Roundcube","patch":"patched"}],"url":"https://hard.fyi/live/roundcube-webmail-exploited-flaws-feb-2026/","json":"https://hard.fyi/api/live?id=roundcube-webmail-exploited-flaws-feb-2026"}