Vulnerability intelligence
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
Roundcube Webmail
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVSS Score
9.3
Critical
EPSS — Exploit Probability
83%
Riskier than 100% of all CVEs · checked 2026-10-05
Exploitation
Confirmed in the wild
KEV since 2025-06-09
Remediation
Patch available
Federal deadline 2025-06-30
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-06-30.
2 articles across 2 outlets · first covered Jul 7, 2026 · latest Jul 13, 2026
Associated threat actors
Coverage timeline
-
UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departmentssecurityonline.info · Jul 13, 2026
-
China linked hackers hit US Canada universities via Roundcubewww.infosecurity-magazine.com · Jul 7, 2026