CISA Adds Actively Exploited Roundcube Webmail Vulnerabilities to KEV Catalog
Active Exploitation · 10 sources · Updated 4mo ago · First seen Feb 21, 2026
CISA added two Roundcube Webmail vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation: CVE-2025-49113 (CVSS 9.9), a deserialization issue enabling authenticated remote code execution due to improper validation of the _from URL parameter in program/actions/settings/upload.php, and CVE-2025-68461 (CVSS 7.2), an XSS flaw involving the animate tag in an SVG document. CISA directed U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate by 2026-03-13, and advised applying vendor mitigations per guidance (or discontinuing use if mitigations are unavailable).
The KEV repository updates for 2026-02-20 reflect both Roundcube entries, including mappings to CWE-502 (deserialization) and CWE-79 (XSS) and links to Roundcube advisories/releases. Reporting also noted that researchers observed rapid attacker uptake of CVE-2025-49113 after disclosure, including claims that attackers quickly “diffed and weaponized” the bug and that exploit access was offered for sale shortly after. Separate reporting about BeyondTrust Remote Support/Privileged Remote Access (CVE-2026-1731) describes a different KEV addition and is not part of the Roundcube event.
