CVE-2025-68461

RoundCube Webmail Cross-site Scripting Vulnerability

Roundcube Webmail

RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

CVSS Score

—

Unrated

EPSS — Exploit Probability

27%

Riskier than 98% of all CVEs · checked 2026-09-04

Exploitation

Confirmed in the wild

KEV since 2026-02-20

Remediation

Unconfirmed

Federal deadline 2026-03-13

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-13.

NVD entry CISA KEV

3 articles across 3 outlets · first covered Feb 23, 2026 · latest Feb 23, 2026

Coverage timeline

CISA urges patches for RoundCube webmail after CVE-2025-49113
www.securityweek.com · Feb 23, 2026
CISA adds Roundcube webmail RCE CVE-2025-49113 to KEV after sale
thehackernews.com · Feb 23, 2026
CISA warns: RoundCube webmail RCE CVE-2025-49113 hits millions
securityaffairs.com · Feb 23, 2026

Related CVEs — Roundcube

CVE-2025-49113KEV CVE-2024-42009KEV CVE-2026-54433 CVE-2026-48842 CVE-2026-48844