Loading vulnerability…
Remote Code Execution in Roundcube Webmail markasjunk cmd_learn Driver
CVE-2026-74997 is an OS command injection vulnerability in the cmd_learn driver of Roundcube Webmail's markasjunk plugin. Crafted placeholder replacement values can cause arbitrary code execution on the server. Affected versions are 1.6.x before 1.6.18 and 1.7.x before 1.7.3. Only instances configured to use markasjunk with the cmd_learn driver are affected. Exploitation requires low privileges and no user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary server-side code execution, with high potential impact to confidentiality, integrity, and availability. An attacker could access or alter data available to the affected process and disrupt the webmail service. Operating-system privilege escalation is not established.
If you can’t patch tonight, do this now.
Until an update can be deployed, disable the markasjunk plugin or stop using its cmd_learn driver. Instances that do not use markasjunk with cmd_learn are not affected by this vulnerability.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), install Roundcube version 1.6.18+dfsg-0+deb13u1 or later through the security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.