RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV)

Key facts

Detection coverage

As of 2026-02-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0130 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Post-RCE Email Spool Exfiltration, Forwarding Persistence, and Lateral Movement

Detects post-RCE activities: www-data accessing /var/mail/ or Maildir (email collection T1114.001), .forward or Sieve rule modification for persistent email access (T1098), account enumeration via database queries (T1087.003), www-data downloading tools via wget/curl (T1105), and log tampering (T1070.004).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1114.001, T1098, T1087.003, T1105, T1070.004
• Data sources: linux_auditd, file_access_logs, process_creation_logs, network_flow_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=os sourcetype="linux:auditd"
| search (user="www-data" OR user="apache")
| eval alert=case(
    match(name, "(/var/mail/|/Maildir/)"), "email_spool_access",
    match(name, "(\.forward|\.sieve|sieve\.d)"), "forwarding_persistence",
    match(exe, "(wget|curl)"), "tool_download",
    match(name, "config\.inc\.php"), "config_harvest",
    match(_raw, "SELECT.*FROM.*users"), "account_enumeration",
    1=1, "other"
)
| where alert!="other"
| table _time, user, exe, name, path, alert
| sort -_time

Microsoft KQL

let mail_access = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where FolderPath has_any ("/var/mail/", "/Maildir/")
| extend AlertType = "email_spool_access";
let forwarding = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where FileName has_any (".forward", ".sieve")
| extend AlertType = "forwarding_persistence";
let tools = DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName in ("www-data", "apache")
| where FileName in ("wget", "curl", "python3")
| extend AlertType = "tool_download";
let exfil = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in ("www-data", "apache")
| where RemotePort in (443, 80, 8443, 4443)
| where RemoteIPType == "Public"
| summarize TotalBytes = sum(SentBytes) by RemoteIP, bin(Timestamp, 1h)
| where TotalBytes > 10000000
| extend AlertType = "large_data_exfiltration";
union mail_access, forwarding, tools, exfil
| project Timestamp, AlertType, InitiatingProcessAccountName, FileName, FolderPath, RemoteIP, TotalBytes
| sort by Timestamp desc

Sigma

title: Web Server Process Accessing Mail Spool After RoundCube RCE
id: 085addce-fc46-4449-b4a6-9498747ab8da
status: experimental
description: Detects www-data/apache reading /var/mail/ or Maildir — email collection after RoundCube CVE-2025-49113 RCE exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49113
author: Threadlinqs Team
date: 2026/02/22
tags:
    - attack.collection
    - attack.t1114.001
    - attack.persistence
    - attack.t1098
    - attack.defense_evasion
    - attack.t1070.004
logsource:
    product: linux
    category: file_access
detection:
    selection:
        TargetFilename|contains|any:
            - '/var/mail/'
            - '/Maildir/'
        User|any:
            - 'www-data'
            - 'apache'
    condition: selection
falsepositives:
    - Legitimate mail delivery agents writing to mail spool
    - Backup scripts running as www-data (misconfigured)
level: critical

Known false positives:

• Legitimate mail delivery agents
• Backup scripts misconfigured as www-data

Tuning notes: Monitor /var/mail/ and Maildir access by web server users. Alert on .forward/.sieve changes by non-user processes. Track data volume from mail server to external IPs.

• 🔒 RoundCube Chained Exploit Detection — SVG XSS Email to Session Hijack to Deserialization RCE · unlock with TL Creds
• 🔒 RoundCube Post-RCE Activity — Webshell, Config Credential Harvest, and Email Spool Access · unlock with TL Creds
• 🔒 RoundCube Post-Compromise Data Exfiltration, Email Forwarding Persistence, and C2 Communication · unlock with TL Creds
• 🔒 Email Containing SVG Animate/Set Tag Targeting RoundCube XSS (CVE-2025-68461) · unlock with TL Creds
• 🔒 RoundCube Config File Read by Web Server Process (IMAP/DB Credential Harvest) · unlock with TL Creds
• 🔒 Outbound Request from Webmail Session Containing Cookie Data (Session Theft) · unlock with TL Creds
• 🔒 RoundCube Deserialization Exploit via settings/upload.php and SVG XSS Email Delivery · unlock with TL Creds
• 🔒 RoundCube Session Hijack and Post-RCE Webshell Deployment with Config Credential Harvest · unlock with TL Creds

Indicators of compromise

As of 2026-02-22, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-0130.

Technical analysis

CVE-2025-68461 (CVSS 7.2) is a stored cross-site scripting vulnerability via the SVG animate tag, reported by CrowdStrike. Together t

## Overview

On February 20, 2026, CISA added two RoundCube Webmail vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive (BOD) 22-01, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate. Both vulnerabilities have confirmed active exploitation in the wild.

## CVE-2025-49113 — Post-Auth RCE via PHP Object Deserialization (CVSS 9.9)

### Vulnerability Details

RoundCube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the `_from` parameter in a URL is not validated in `program/actions/settings/upload.php`, leading to PHP Object Deserialization. This vulnerability was reported by Kirill Firsov and published by FearsOff research.

The vulnerability exists in the file upload handler within RoundCube's settings module. The `_from` parameter, intended to indicate the source page of the upload request, is passed directly to PHP's `unserialize()` function without validation. An authenticated attacker can craft a malicious serialized PHP object that, when deserialized, triggers arbitrary code execution on the server via PHP magic methods (__wakeup, __destruct, __toString) and existing gadget chains in the RoundCube codebase or its dependencies.

### Attack Requirements - **Authentication required**: The attacker needs a valid RoundCube session (any user-level account) - **No user interaction**: Once authenticated, exploitation is automated - **Network accessible**: RoundCube webmail is typically internet-facing on ports 80/443 - **Low complexity**: Serialized PHP payloads are well-documented, and tools like PHPGGC provide ready-made gadget chains

### Impact - Full remote code execution on the web server as the web server user (typically www-data or apache) - Access to all email accounts on the server (mail spool, IMAP credentials) - Lateral movement to database server (RoundCube stores sessions and contacts in MySQL/PostgreSQL) - Potential privilege escalation if web server process has elevated permissions - Webshell deployment for persistent access

### CVSS - **MITRE Score**: 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - **NVD Score**: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Affected Versions - RoundCube Webmail < 1.5.10 - RoundCube Webmail 1.6.0 through 1.6.10 - Debian Linux 11 (ships vulnerable RoundCube package)

### Fixed Versions - RoundCube 1.5.10 (released June 1, 2025) - RoundCube 1.6.11 (released June 1, 2025)

## CVE-2025-68461 — Stored XSS via SVG Animate Tag (CVSS 7.2)

### Vulnerability Details

RoundCube Webmail before 1.5.12 and 1.6.x before 1.6.12 is vulnerable to Cross-Site Scripting (XSS) via the animate tag in an SVG document. This vulnerability was reported by Valentin T. from CrowdStrike.

The vulnerability exists in RoundCube's HTML sanitizer, which fails to properly handle SVG `<animate>` elements. An attacker can embed a malicious SVG document in an email that contains an `<animate>` tag with event handlers or attribute manipulation that executes JavaScript in the context of the victim's browser session when the email is viewed.

### Attack Requirements - **No authentication required**: Attacker sends a crafted email to the victim - **User interaction**: Victim must open/view the malicious email in RoundCube webmail - **Network accessible**: Email delivery to the target RoundCube instance

### Impact - Session cookie theft (RoundCube session tokens) - Credential harvesting via fake login forms injected into the webmail interface - Email content exfiltration (read victim's emails via JavaScript) - Account takeover by stealing session tokens - Chaining with CVE-2025-49113: XSS provides the initial foothold (stolen credentials or session) to authenticate and exploit the deserialization RCE

### CVSS - **MITRE Score**: 7.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) - **NVD Score**: 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Affected Versions - RoundCube Webmail < 1.5.12 - RoundCube Webmail 1.6.0 through 1.6.11

### Fixed Versions - RoundCube 1.5.12 (released December 13, 2025) - RoundCube 1.6.12 (released December 13, 2025)

## Chained Exploitation Scenario

These two vulnerabilities represent a complete compromise chain:

1. **Phase 1 — XSS (CVE-2025-68461)**: Attacker sends a crafted email containing a malicious SVG with an animate tag to a target user. When the victim views the email, JavaScript executes and steals the session cookie or captures credentials via a fake login overlay.

2. **Phase 2 — Authentication**: Attacker uses the stolen session cookie or credentials to authenticate to RoundCube as the victim.

3. **Phase 3 — RCE (CVE-2025-49113)**: With an authenticated session, the attacker exploits the deserialization vulnerability in the settings upload handler, sending a crafted serialized PHP object via the _from parameter to achieve remote code execution on the server.

4. **Phase 4 — Post-Exploitation**: Full server access — webshell deployment, email spool access, lateral movement to database, credential harvesting from IMAP configuration.

## Nation-State Context

RoundCube has been a repeated target for nation-state actors:

- **Winter Vivern / TAG-70**: Exploited CVE-2023-5631 (XSS) to target European government and military email systems in 2023. Campaign documented by ESET, targeting Ukrainian and European entities. - **APT28 / Fancy Bear**: Exploited CVE-2020-35730 (XSS) in campaigns against Ukrainian government email servers in 2022-2023, documented by Recorded Future. - **Pattern**: Both CVEs follow the same attack pattern — XSS via email rendering to steal sessions, followed by post-exploitation. The current active exploitation of CVE-2025-49113 and CVE-2025-68461 likely follows the same nation-state playbook.

## Remediation

### Immediate Actions - Update to RoundCube 1.6.12 or 1.5.12 (patches both CVEs) - If immediate patching is not possible, restrict access to RoundCube webmail via VPN or IP allowlisting - Review web server logs for exploitation indicators (anomalous POST to settings/upload.php with serialized data in _from parameter) - Review webmail access logs for session anomalies (session reuse from different IPs) - Check for webshells in the RoundCube web root and temp directories

### Long-Term Defenses - Implement WAF rules to block serialized PHP objects in URL parameters - Enable Content-Security-Policy headers to mitigate XSS impact - Migrate to a supported, actively maintained webmail solution if running EOL versions - Implement MFA for webmail access - Network segmentation — isolate webmail servers from internal network - Subscribe to RoundCube security announcements for timely patching

MITRE ATT&CK techniques by tactic:

defense-evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1550.004 Web Session Cookie

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

collection

T1056.003 Web Portal Capture; T1114.001 Local Email Collection; T1114.002 Remote Email Collection; T1213 Data from Information Repositories

execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.003 Email Account

persistence

T1098 Account Manipulation; T1505.003 Web Shell

initial-access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

impact

T1531 Account Access Removal

credential-access

T1539 Steal Web Session Cookie; T1552.001 Credentials In Files

resource-development

T1587.004 Exploits

Remediation

Patches

• RoundCube 1.6.12 — fixes CVE-2025-68461 (XSS) + earlier patches
• RoundCube 1.5.12 — fixes CVE-2025-68461 (XSS) + earlier patches
• RoundCube 1.6.11 — fixes CVE-2025-49113 (Deserialization RCE)
• RoundCube 1.5.10 — fixes CVE-2025-49113 (Deserialization RCE)
• Debian Security Advisory for Debian 11 (DSA pending)

Immediate actions

• Update RoundCube to 1.6.12 or 1.5.12 (patches both CVEs)
• If patching is delayed, restrict webmail access via VPN or IP allowlisting
• Review web server logs for POST requests to settings/upload.php with serialized data in _from parameter
• Check for webshells in RoundCube web root and temp directories
• Review session logs for anomalous IP changes within sessions
• Audit email access for signs of compromise (forwarding rules, unauthorized reads)

Workarounds

• Block access to settings/upload.php endpoint if upload functionality is not required
• Implement CSP headers to prevent XSS payload execution
• Restrict RoundCube to VPN-only access
• Disable SVG rendering in email display settings if possible

Longer-term hardening

• Implement WAF rules blocking serialized PHP objects in URL parameters
• Enable Content-Security-Policy headers on webmail
• Implement MFA for webmail authentication
• Network segmentation — isolate webmail from internal systems
• Migrate from EOL RoundCube versions to supported releases
• Subscribe to RoundCube security announcements
• Deploy web application firewall with PHP deserialization detection

Affected and fixed versions

• Roundcube — Webmail
  Vulnerable versions: < 1.5.10 (CVE-2025-49113); 1.6.0-1.6.10 (CVE-2025-49113); < 1.5.12 (CVE-2025-68461); 1.6.0-1.6.11 (CVE-2025-68461)
  Fixed in: 1.5.10+ (CVE-2025-49113); 1.6.11+ (CVE-2025-49113); 1.5.12+ (CVE-2025-68461); 1.6.12+ (CVE-2025-68461)
• Debian — Debian Linux 11
  Vulnerable versions: Ships vulnerable RoundCube package
  Fixed in: Pending security update

Timeline

• 2025-06-01 RoundCube releases 1.6.11 and 1.5.10 fixing CVE-2025-49113 (Post-Auth RCE via PHP Object Deserialization). Reported by Kirill Firsov. Source: https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
• 2025-06-02 FearsOff publishes detailed technical analysis of CVE-2025-49113 RoundCube deserialization vulnerability. Source: https://fearsoff.org/research/roundcube
• 2025-06-02 CVE-2025-49113 published on NVD. CVSS 9.9 (MITRE) / 8.8 (NVD). CWE-502 Deserialization of Untrusted Data. OpenWall oss-security disclosure. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-49113
• 2025-06-15 Debian LTS security update issued for RoundCube on Debian 11. Vicarius publishes mitigation script for CVE-2025-49113.
• 2025-12-13 RoundCube releases 1.6.12 and 1.5.12 fixing CVE-2025-68461 (XSS via SVG animate tag). Reported by Valentin T. from CrowdStrike. Source: https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12
• 2025-12-18 CVE-2025-68461 published on NVD. CVSS 7.2 (MITRE) / 6.1 (NVD). CWE-79 Cross-Site Scripting. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-68461
• 2026-02-20 CISA adds both CVE-2025-49113 and CVE-2025-68461 to Known Exploited Vulnerabilities catalog based on evidence of active exploitation. BOD 22-01 mandates federal remediation. Source: https://www.cisa.gov/news-events/alerts/2026/02/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
• 2026-02-22 Threadlinqs Intelligence Platform publishes TL-2026-0130 with full exploit chain analysis, nation-state context, and detection coverage.
• 2026-05-29 As of 2026-05-29, both Roundcube CVEs remain PATCHED (RCE fixed June 2025 in 1.6.11/1.5.10; SVG XSS fixed Dec 2025 in 1.6.12/1.5.12) yet still actively exploited per the CISA KEV listing (added 2026-02-20, deadline 2026-03-13). 84,000+ unpatched internet-facing instances persist, with weaponized exploits sold publicly and CamoFei deploying Godzilla/Pupy; no takedown or successor reported.

Sources cited

• CISA Adds Two Known Exploited Vulnerabilities to Catalog (Feb 20, 2026) CISA · Government advisory · 2026-02-20
• NVD — CVE-2025-49113: RoundCube Deserialization RCE NVD (NIST) · Advisory · 2025-06-02
• NVD — CVE-2025-68461: RoundCube XSS via SVG Animate NVD (NIST) · Advisory · 2025-12-18
• OpenWall oss-security: RoundCube CVE-2025-49113 Disclosure openwall.com · Advisory · 2025-06-02
• Debian LTS Announce: RoundCube Security Update lists.debian.org · Advisory · 2025-06-15
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-02-20
• BOD 22-01: Reducing Significant Risk of Known Exploited Vulnerabilities CISA · Government advisory · 2021-11-03
• RoundCube Security Updates 1.6.11 and 1.5.10 (CVE-2025-49113 fix) roundcube.net · Vendor report · 2025-06-01
• RoundCube Security Updates 1.6.12 and 1.5.12 (CVE-2025-68461 fix) roundcube.net · Vendor report · 2025-12-13
• FearsOff Research — RoundCube Post-Auth RCE via PHP Object Deserialization fearsoff.org · Research · 2025-06-02
• Vicarius — CVE-2025-49113 Mitigation Script vicarius.io · Research · 2025-06-15
• GitHub: RoundCube Patch Commit for CVE-2025-49113 GitHub · Code repository · 2025-06-01
• GitHub: RoundCube Pull Request #9865 (Deserialization Fix) GitHub · Code repository · 2025-06-01
• GitHub: RoundCube Patch Commit for CVE-2025-68461 (SVG XSS) GitHub · Code repository · 2025-12-13

Related threats

• UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers
• APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing

More from APT28

• APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex
• APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics
• APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor
• APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers to enable DNS hijacking and AitM credential theft (CVE-2023-50224) - FrostArmada / Operation Masquerade
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)

Other reports on CVE-2025-49113

• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry
• Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)
• Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)

Previous and next in vulnerability

• BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign Previous report
• Windows False File Immutability Kernel Exploit — Cloud File Sync Driver (cldflt.sys) Bypass, PoC Available, Forever-Day on Multiple Windows Versions Next report

Further reading

• Roundcube CVE-2025-49113 and CVE-2025-68461