Hackers now exploit critical Roundcube flaw in code injection attacks
Source Bleeping Computer
Rated High by Bleeping Computer
Data as of 24 Sep 2026, 13:32 UTC
What to do
AI-suggested
A patch for this vulnerability was released in May. It is critical to ensure that the Roundcube Webmail installation is updated to the latest patched version to mitigate the risk. No additional mitigation guidance is provided by the vendor advisory.
Description
A high-severity vulnerability in Roundcube Webmail, patched in May, is currently being exploited in code injection attacks as reported by the Canadian Centre for Cyber Security. The flaw allows attackers to inject malicious code, posing significant risk to affected systems. No specific affected versions or CVSS score are provided. The vulnerability is actively exploited in the wild, highlighting the importance of applying the available patch.