NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Roundcube Webmail flaws CVE-2025-49113 and CVE-2025-68461 used in attacks; fixes available

Two patched Roundcube Webmail flaws are being exploited: one lets logged-in attackers run code on the server; the other runs scripts in users’ browsers. Ask your email provider or IT team to confirm its server is updated and checked for compromise.

What to do

If your email uses Roundcube, ask your email provider or IT team to install the latest supported release and confirm it includes both fixes, first combined in 1.5.12 and 1.6.12. Ask them to check the server for compromise as well as updating it; this is a server update they must handle.

What’s happening

These flaws affect Roundcube Webmail, the browser-based email software run by hosting providers and organisations. CVE-2025-49113 lets an attacker with a valid login run code on the server; Roundcube fixed it in 1.5.10 and 1.6.11 in June 2025. CVE-2025-68461 lets malicious SVG content run scripts in a user’s browser session; it was fixed in 1.5.12 and 1.6.12 in December 2025. Those December releases contain both fixes. CISA listed both as exploited on 20 February 2026. In July, Proofpoint described attacks using the server flaw against university departments from May and said identified victims were being notified. That campaign used a different browser flaw, not CVE-2025-68461. As at 3 November, fixes remain available; the reviewed sources do not establish that attacks have ended. Roundcube’s notices give no severity ratings. MITRE’s CVE records score the flaws 9.9 and 7.2 respectively, while NVD scores them 8.8 and 6.1.

What
Flaw
Affects
Roundcube Webmail
Affected
CVE-2025-49113: Roundcube Webmail before 1.5.10; 1.6.x before 1.6.11
CVE-2025-68461: Roundcube Webmail before 1.5.12; 1.6.x before 1.6.12
Fixed in
CVE-2025-49113: Roundcube Webmail 1.5.10 and 1.6.11
CVE-2025-68461: Roundcube Webmail 1.5.12 and 1.6.12
CVE
CVE-2025-49113, CVE-2025-68461
Since
20 Feb 2026
Closed
10 July 2026

Timeline

  1. Update

    Canada’s Cyber Centre updated its alert to highlight reported ongoing exploitation of CVE-2025-49113. It urged organisations to update Roundcube and monitor for signs of compromise.

  2. Wider attacks

    Proofpoint reported attacks observed since May against physics and engineering departments at US and Canadian universities, using CVE-2025-49113 after a separate, older browser scripting flaw. Attackers stole credentials and installed backdoors; Proofpoint coordinated notification of identified victims.

  3. CISA added

    CISA added both flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in attacks. US federal civilian agencies were given until 13 March to address them.

  4. New fixFixed

    Roundcube released 1.5.12 and 1.6.12 to fix the SVG cross-site scripting flaw CVE-2025-68461. These versions include fixes for both flaws in this record.

  5. New fixFixed

    Roundcube released 1.5.10 and 1.6.11 to fix the authenticated server code-execution flaw later identified as CVE-2025-49113.

Sources

  1. Security updates 1.6.11 and 1.5.10 releasedRoundcube · 1 June 2025
  2. Security updates 1.6.12 and 1.5.12 releasedRoundcube · 13 Dec 2025
  3. CVE-2025-49113: CVE record and mirrored CISA/NVD dataCIRCL Vulnerability-Lookup · 21 Feb 2026
  4. CVE-2025-68461: CVE record and mirrored CISA/NVD dataCIRCL Vulnerability-Lookup · 26 Feb 2026
  5. CISA Adds Two Actively Exploited Roundcube Flaws to KEV CatalogThe Hacker News · 21 Feb 2026
  6. Hackers target vulnerabilities in Roundcube WebmailCybersecurity Dive · 23 Feb 2026
  7. One Email Closer to the Edge: UNK_MassTraction & the Physics of ExploitationProofpoint · 7 July 2026
  8. AL25-007: Vulnerability impacting Roundcube Webmail – CVE-2025-49113 – Update 1Canadian Centre for Cyber Security · 10 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS