DSA-6479-1 roundcube - security update
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, SSRF bypass, information disclosure, privilege escalation, denial of service or remote code execution. https://security-tracker.debian.org/tracker/DSA-6479-1
CSIRTS triage
- What
- Multiple vulnerabilities including cross-site scripting, SSRF bypass, information disclosure, privilege escalation, denial of service, and remote code execution were discovered in Roundcube.
- Who is affected
- Deployments running vulnerable versions of Roundcube webmail.
- Urgency
- High urgency; remote code execution and privilege escalation vulnerabilities require immediate patching.
- Action
- Apply the security update from Debian DSA-6479-1 or upgrade to a patched version of Roundcube.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Roundcube
Get an email when a new Roundcube advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00390.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-749970.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-749980.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-749990.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750000.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-750021.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750030.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750040.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750060.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750070.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-750100.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-74997 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-74998 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-74999 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75000 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75002 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75003 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75004 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75006 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75007 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75010 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Roundcube Webmail: Multiple vulnerabilitiescert-bund
- mediumCVE-2026-75010: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password …nvd
- mediumCVE-2026-75007: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject …nvd
- mediumCVE-2026-75006: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets…nvd
- mediumCVE-2026-75004: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could le…nvd
- mediumCVE-2026-75003: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attr…nvd
- highCVE-2026-75002: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count…nvd
- mediumCVE-2026-75000: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of t…nvd
- mediumCVE-2026-74999: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action wa…nvd
- highCVE-2026-74998: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading S…nvd
- highCVE-2026-74997: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasj…nvd
More from Debian Security Advisories
- unknownDSA-6481-1 firefox-esr - security update2026-09-02
- unknownDSA-6480-1 keystone - security update2026-09-01
- unknownDSA-6478-1 starlette - security update2026-08-30
- unknownDSA-6477-1 linux - security update2026-08-29
- unknownDSA-6474-1 cockpit - security update2026-08-27