Vulnerability intelligence

CVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVSS Score

9.9

Critical

EPSS — Exploit Probability

99%

Riskier than 100% of all CVEs · checked 2026-10-12

Exploitation

Confirmed in the wild

KEV since 2026-02-20

Remediation

Patch available

Federal deadline 2026-03-13

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-13.

NVD entry Vendor patch PoC / advisory CISA KEV

5 articles across 5 outlets · first covered Jul 13, 2026 · latest Aug 11, 2026

Associated threat actors

UNK_MassTraction Lazarus Group

Coverage timeline

Lazarus hits defence via fake job PDFs, CVE-2026-68820
research.checkpoint.com · Aug 11, 2026
UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments
securityonline.info · Jul 13, 2026
CISA urges patches for RoundCube webmail after CVE-2025-49113
www.securityweek.com · Feb 23, 2026
CISA adds Roundcube webmail RCE CVE-2025-49113 to KEV after sale
thehackernews.com · Feb 23, 2026
CISA warns: RoundCube webmail RCE CVE-2025-49113 hits millions
securityaffairs.com · Feb 23, 2026

Related CVEs — Roundcube

CVE-2026-48842 CVE-2024-42009KEV CVE-2026-54433 CVE-2026-48844 CVE-2025-68461KEV