internet-facing-service-vulnerabilityproof-of-concept-releasewidely-deployed-product-advisoryrapid-weaponization
Authenticated Remote Code Execution Flaw in Roundcube Webmail
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Aug 31, 2026
Roundcube remediated CVE-2025-49113, a serious vulnerability that allows an authenticated attacker to execute arbitrary code remotely on affected Roundcube Webmail servers. Successful exploitation could enable exposure of sensitive data and compromise of the mail environment.
The Dutch National Cyber Security Centre reported that public exploit code is circulating, raising the likelihood of abuse, and rated both likelihood and impact as High. Organizations running the 1.6.x branch should upgrade to 1.6.11, while those using the 1.5.x LTS branch should upgrade to 1.5.10 as soon as possible.
Do you run this?See affected versions and whether adversaries are exploiting it.
Check your exposure
