CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

Multiple vulnerabilities in Roundcube (August 10, 2026)

unknown
Multiple vulnerabilities were discovered in Roundcube. Some of them allow an attacker to cause arbitrary code execution remotely, compromise data confidentiality, and server-side request forgery (SSRF).

CSIRTS triage

vendor: Roundcubeproduct: RoundcubeRemote code executionInformation disclosureServer-side request forgery
What
Multiple vulnerabilities in Roundcube allow arbitrary code execution, data confidentiality compromise, and server-side request forgery.
Who is affected
Roundcube installations exposed to remote attackers.
Urgency
High priority; remote code execution capability represents critical risk requiring immediate remediation.
Action
Apply Roundcube patches once released to address remote code execution vulnerability.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Roundcube

Get an email when a new Roundcube advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-FR Avis de sécurité (FR · national-cert · site)
Severity
unknown
Published
2026-08-10
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0987/

Recent advisories for Roundcube

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-FR Avis de sécurité