Vulnerability intelligence
CVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVSS Score
7.2
High
EPSS — Exploit Probability
27%
Riskier than 98% of all CVEs · checked 2026-10-18
Exploitation
Confirmed in the wild
KEV since 2026-02-20
Remediation
Unconfirmed
Federal deadline 2026-03-13
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-13.
3 articles across 3 outlets · first covered Feb 23, 2026 · latest Feb 23, 2026
Coverage timeline
-
CISA urges patches for RoundCube webmail after CVE-2025-49113www.securityweek.com · Feb 23, 2026
-
CISA adds Roundcube webmail RCE CVE-2025-49113 to KEV after salethehackernews.com · Feb 23, 2026
-
CISA warns: RoundCube webmail RCE CVE-2025-49113 hits millionssecurityaffairs.com · Feb 23, 2026