Threat reportVulnerabilityTL-2026-1185
Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432, CVE-2026-54433) — Versions Prior to 1.6.17 / 1.7.2
Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432 (TL-2026-1185) is a high-severity software vulnerability, first published 2026-07-10. It has no confirmed attribution, affects Roundcube Roundcube Webmail, references 2 CVEs (CVE-2026-54432, CVE-2026-54433), maps to 17 MITRE ATT&CK techniques (T1059, T1071, T1114), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1185
- Threat ID
- TL-2026-1185
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, hosting-providers, government administration, education, small-and-medium-business, any-sector-running-self-hosted-webmail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
How Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432 works
Roundcube Webmail versions prior to 1.6.17 and 1.7.2 contain two zero-click stored XSS vulnerabilities: CVE-2026-54432 executes arbitrary JavaScript via an unescaped attachment MIME type on the attachment-validation warning page, and CVE-2026-54433 injects malicious scripts that execute silently when a message is viewed in plain-text mode. Neither requires user interaction beyond opening or previewing an email.
On 2026-07-05 the Roundcube project released security updates 1.6.17 and 1.7.2 patching six issues, two of which are zero-click stored cross-site scripting vulnerabilities reported by Bohdan Kurinnoy of Samsung R&D Institute Ukraine (SRUKR). CVE-2026-54432 stems from the attachment-validation warning page failing to escape the MIME type string associated with an uploaded/received attachment; because Roundcube renders this warning automatically when a message containing a suspicious or blocked attachment type is opened, an attacker who controls the MIME type field of a crafted attachment can inject and execute arbitrary JavaScript in the victim's webmail session the moment the warning page loads — no click, download, or explicit user action required beyond viewing the message. GitHub release notes for 1.6.17 describe the fix as making the attachment-validation warning page properly escape MIME type data (tracked upstream alongside issue #10193 for an unrelated TNEF fix in the same release). CVE-2026-54433 is a stored XSS in Roundcube's plain-text message rendering engine: content that should be rendered as inert text is instead interpreted and executed as script when the recipient views the message in plain-text mode, a mode users often trust as inherently safe from HTML-borne script injection, which defeats the visual/behavioral cues (e.g., 'blocked images' or 'view as HTML' prompts) users rely on to spot suspicious mail. Because Roundcube is server-rendered webmail, any script executing in the DOM runs in the authenticated session origin and can read the DOM, issue XHR/fetch requests using the victim's session cookie, exfiltrate mail contents, or, per community discussion of the disclosure, exfiltrate the session token itself to enable full account/mailbox takeover. Both CVEs were disclosed and patched simultaneously alongside four other Roundcube 1.6.17/1.7.2 fixes, per the vendor's own release notes and changelog: (1) an infinite loop in the TNEF (winmail.dat) decoder enabling a denial-of-service via malformed attachments (GitHub issue #10193, reported by stafra); (2) password-plugin vulnerabilities involving session-injected usernames (reported by Glendaenri and peppersghost); (3) two additional SSRF bypass cases exploitable via local-address URL formats (reported by Leenear); and (4) a denial-of-service via crafted compressed-RTF size values inside TNEF attachments (reported by h0rk1p). The same 1.6.17 release also shipped two unrelated feature additions (Enigma automatic public-key lookup via HKP v1, tracked as #5314, and Enigma Kolab WOAT support, #8626) that are not security-relevant to this threat. As of this research, NVD has not yet published CVSS scores for CVE-2026-54432/CVE-2026-54433 (empty NVD API results at time of analysis, confirmed via direct NVD REST query on 2026-07-10); no public PoC exploit code or confirmed in-the-wild exploitation has been identified for these two specific CVEs — CERT-FR's advisory (CERTFR-2026-AVI-0835) catalogs the same release's issues as a mix of security-bypass, DoS, SSRF, and XSS-via-indirect-code-injection categories without assigning independent severity beyond referencing the vendor bulletin. This is not Roundcube's first appearance on CISA's Known Exploited Vulnerabilities (KEV) catalog: in February 2026, CISA added two earlier, unrelated Roundcube flaws — CVE-2025-49113 (CVSS 9.9, deserialization-of-untrusted-data remote code execution for authenticated users, patched June 2025) and CVE-2025-68461 (CVSS 7.2, SVG-animate-tag cross-site scripting, patched December 2025) — to the KEV catalog after confirming active exploitation, with a federal remediation deadline of 2026-03-13. Neither CVE-2026-54432 nor CVE-2026-54433 currently appears in the KEV catalog, but the vendor's recurring cadence of XSS/RCE/SSRF findings and its history of rapid weaponization after disclosure (the CVE-2025-49113 RCE was reportedly weaponized within 48 hours of disclosure per prior reporting) elevate the urgency of patching even absent a CVSS score. Given the zero-click nature, the wide deployment of Roundcube as a self-hosted webmail platform (including bundled use in hosting-panel stacks such as DirectAdmin/cPanel), and the low complexity of exploitation described by the discloser, defenders should treat unpatched instances as high risk despite the absence of a formal CVSS score.
MITRE ATT&CK techniques used in TL-2026-1185
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol
Collection
T1114 Email Collection; T1213 Data from Information Repositories
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Defense Evasion
T1211 Exploitation for Stealth
Impact
T1499 Endpoint Denial of Service; T1531 Account Access Removal
Persistence
T1505 Server Software Component
Discovery
Credential Access
T1539 Steal Web Session Cookie
lateral-movement
T1550 Use Alternate Authentication Material
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
Affected products and versions in Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
- Roundcube — Roundcube Webmail
Vulnerable versions: 1.6.0-1.6.16; 1.7.0-1.7.1
Fixed in: 1.6.17; 1.7.2
Remediation for Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
Patches
- Roundcube Webmail 1.6.17 (fixes CVE-2026-54432, CVE-2026-54433, and 4 additional issues)
- Roundcube Webmail 1.7.2 (fixes CVE-2026-54432, CVE-2026-54433, and 4 additional issues)
Immediate actions
- Upgrade all Roundcube Webmail 1.6.x installations to 1.6.17
- Upgrade all Roundcube Webmail 1.7.x installations to 1.7.2
- Audit hosting-panel bundles (e.g., DirectAdmin CustomBuild, cPanel) for delayed Roundcube package updates and force an out-of-band update if the panel vendor has not shipped 1.6.17/1.7.2
- Review Roundcube authentication logs for anomalous session activity following message previews around and after 2026-07-05
- Cross-check the same environment for the earlier CVE-2025-49113 and CVE-2025-68461 KEV-listed Roundcube flaws, since organizations behind on Roundcube patching are frequently behind on multiple releases at once
Workarounds
- No official workaround published; disabling attachment-validation warning display and plain-text rendering is not supported by upstream and is not a recommended substitute for patching
Longer-term hardening
- Deploy a strict Content-Security-Policy on the webmail origin to constrain inline script execution as defense-in-depth against future stored-XSS regressions
- Isolate webmail session cookies with HttpOnly/SameSite=Strict and short session lifetimes to reduce blast radius of any future DOM-based script execution
- Establish a patch-monitoring process for Roundcube security bulletins (roundcube.net/news) given the recurring cadence of XSS/SSRF/DoS findings in this codebase
- Consider sandboxing or disabling plain-text mode auto-rendering of attacker-influenced content pending independent security review of the rendering pipeline
CVEs associated with Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
Weaknesses (CWE) in Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
Timeline of Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
- Roundcube patches CVE-2025-49113 (CVSS 9.9 deserialization-of-untrusted-data RCE), later added to CISA's KEV catalog — established precedent for rapid weaponization of Roundcube vulnerabilities after disclosure.
- Roundcube patches CVE-2025-68461 (SVG animate-tag XSS, CVSS 7.2), also later added to CISA's KEV catalog alongside CVE-2025-49113.
- CISA adds the earlier, unrelated CVE-2025-49113 and CVE-2025-68461 Roundcube flaws to its Known Exploited Vulnerabilities catalog, setting a federal remediation deadline of 2026-03-13 — establishing Roundcube's recurring presence on the KEV list ahead of this threat's disclosure.
- Bohdan Kurinnoy of Samsung R&D Institute Ukraine (SRUKR) privately reports the stored XSS in the attachment-validation warning page (CVE-2026-54432) and the plain-text rendering stored XSS (CVE-2026-54433) to the Roundcube project (approximate; exact private-disclosure date not published).
- GitHub release tag 1.6.17 is published with full changelog crediting each reporter by name and confirming the attachment-validation warning page now properly escapes MIME type data.
- Roundcube project releases security updates 1.6.17 and 1.7.2, fixing CVE-2026-54432, CVE-2026-54433, a TNEF decoder infinite-loop DoS (GitHub issue #10193, reported by stafra), a password-plugin session-injection issue (Glendaenri, peppersghost), two SSRF bypass cases (Leenear), and a compressed-RTF TNEF DoS (h0rk1p).
- CERT-FR publishes advisory CERTFR-2026-AVI-0835 cataloging the multiple Roundcube vulnerabilities fixed in the 1.6.17/1.7.2 release.
- DirectAdmin community forum thread discusses delayed availability of the patched Roundcube packages through the CustomBuild distribution pipeline, noting the update remained unavailable through the hosting panel five days after upstream release, and highlights session/data exfiltration risk from unpatched instances.
- Cyber Security News publishes an article summarizing the zero-click nature of CVE-2026-54432 and CVE-2026-54433 and urging immediate patching.
- TL-Intel-Harness RESEARCH phase compiles and cross-references vendor, CERT, GitHub, and community sources for TL-2026-1185, confirming via direct NVD query that CVSS scoring for both CVEs remains unpublished at time of analysis and that neither CVE currently appears in the CISA KEV catalog.
Sources cited for Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432
- Roundcube 0-Click Vulnerability Allows Attackers to Inject Malicious Scripts
- Security updates 1.6.17 and 1.7.2 released
- Multiples vulnérabilités dans Roundcube - CERT-FR
- Release Roundcube Webmail 1.6.17
- roundcubemail CHANGELOG.md
- Roundcube 1.7.2 / 1.6.17 CVE discussion - DirectAdmin Forums
- NVD CVE-2026-54432 record (pending publication)
- NVD CVE-2026-54433 record (pending publication)
- CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog (CVE-2025-49113, CVE-2025-68461)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-1185
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1185 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.