roundcube News Articles

Roundcube Flaw CVE-2026-48842 Is Now Exploited: Patch 1.6.16 or 1.7.1 to Update

Roundcube CVE-2026-48842 is being exploited in the wild. Check your version and virtuser_query plugin, then update to at least 1.6.16 or 1.7.1.

2 weeks ago

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild - IT Security News

Vendors can use your data to provide services. Declining a vendor can stop them from using the data you shared.Exponential Interactive, Inc d/b/a VDX.tvCookie duration: 90 (days).Data collected and processed:...

2 weeks ago

Critical Roundcube Webmail RCE Vulnerability CVE-2026-48842 Actively Exploited

Attackers are exploiting a critical unpatched vulnerability (CVE-2026-48842) in Roundcube webmail servers, enabling remote code execution via crafted emails without authentication. The flaw affects older versions and has been used to deploy web shells, steal data, and launch ransomware. Organization...

2 weeks ago

Attackers Target Unpatched Roundcube Servers With CVE-2026-48842

Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update.

2 weeks ago

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Roundcube's patched CVE-2026-48842 SQL injection is actively exploited, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1.

3 weeks ago

Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Hackers are exploiting CVE-2026-48842, an unauthenticated SQL injection vulnerability in Roundcube Webmail.

3 weeks ago

Hackers now exploit critical Roundcube flaw in code injection attacks

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.

3 weeks ago

Suspected Chinese snoops caught breaking into universities' Roundcube mailservers

Proofpoint researcher tells The Reg: 'We estimate the total volume of targets would be a few dozen'

CISA: Recently patched RoundCube flaws now exploited in attacks

CISA flagged two Roundcube Webmail vulnerabilities as actively exploited in attacks and ordered U.S. federal agencies to patch them within three weeks.

CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog

CISA added two actively exploited Roundcube flaws to its KEV list, including a 9.9-rated RCE weaponized within 48 hours and an SVG-based XSS bug.

CVE-2025-49113: Critical Roundcube Webmail RCE via PHP Object Deserialization

Learn about CVE-2025-49113, a critical RCE vulnerability in Roundcube Webmail caused by PHP object deserialization. Understand its impact, risk, and patch guidance.

Over 80,000 servers hit as roundcube RCE bug gets rapidly exploited

A critical remote code execution (RCE) vulnerability in Roundcube was exploited days after patch, impacting over 80,000 servers.

Round Cube Vulnerability

Patching Guidance Due to a vulnerability in Roundcube, both Plesk and cPanel require an update, which should be automatically picked up. However, users are recommended to force the update through. If you need...

PoC Code Escalates Roundcube Vuln Threat

The flaw allows an authenticated attacker to gain complete control over a Roundcube webmail server.

PoC Code Escalates Roundcube Vuln Threat

The flaw allows an authenticated attacker to gain complete control over a Roundcube webmail server.

Exploited Vulnerability Impacts Over 80,000 Roundcube Servers

Exploitation of a critical-severity RCE vulnerability in Roundcube started only days after a patch was released.

Over 84,000 Roundcube instances vulnerable to actively exploited flaw

Over 84,000 instances of the Roundcube webmail software are vulnerable to CVE-2025-49113, a critical remote code execution (RCE) vulnerability with a publicly available exploit.

Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113) - Help Net Security

With an exploit being offered for sale and a PoC exploit having been made public, attacks exploiting CVE-2025-49113 in Roundcube are incoming.

Cyware Daily Threat Intelligence, June 06, 2025

A silent takeover is unfolding through cheap, everyday smart devices. The FBI has reported over a million infections tied to BADBOX 2.0, a malware campaign targeting uncertified Android-based smart TVs, tablets, and IoT devices. Preinstalled malware and rogue updates turn these devices into resident...

Hackers Exploiting Roundcube Vulnerability to Steal User Credentials

A spear phishing campaign targeting Polish organizations, where threat actors successfully exploited the CVE-2024-42009 vulnerability in Roundcube webmail systems. 

Hackers Exploit Roundcube Vulnerability to Steal User Credentials via XSS Attack

CERT Polska reports that the attackers leveraged a critical vulnerability in the Roundcube webmail platform—CVE-2024-42009—to steal user credentials with minimal user interaction.

Hacker selling critical Roundcube webmail exploit as tech info disclosed

Hackers are actively exploiting CVE-2025-49113, a critical vulnerability in the widely used Roundcube open-source webmail application that allows remote execution.

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

CERT Polska has observed a spear phishing campaign targeting Polish entities this week. The threat actor attempted to exploit the CVE-2024-42009 vulnerability, which allows JavaScript code to be executed when...

Roundcube Webmail under fire: critical exploit found after a decade

A critical flaw in Roundcube webmail, undetected for 10 years, allows attackers to take over systems and execute arbitrary code.