The open-source webmail software Roundcube Webmail is vulnerable, and attackers can exploit a total of eight vulnerabilities. In the worst case, malicious code could compromise systems. Security updates are available for download.
In a post, the developers assure that the gaps in Roundcube Webmail 1.6.16 and 1.7.1 have been closed. Four of the vulnerabilities are classified with the threat level “ high ” (CVE-2026-48842, CVE-2026-48843, CVE-2026-48848, CVE-2026-48844).
If administrators do not install the security patches, attackers can, among other things, push and execute malicious code on computers through SQL injection and Stored XSS attacks. So far, there are no indications that attackers are already exploiting the vulnerabilities.
Most recently, the developers released a security update for the webmail software in March of this year.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
