# Roundcube vulnerabilities & exploitation **CISA KEV** > As of 2026-10-05, Threadlinqs tracks 16 Roundcube CVEs, 8 in the CISA Known Exploited Vulnerabilities catalog, linked to 10 tracked threat campaigns and 9 named threat actors. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 16 Roundcube CVEs published between 2020-05-15 and 2026-05-15. The busiest month was 2026-05 (8 new CVEs). 8 of them (50%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 16 of 16 tracked Roundcube CVEs. - [CVE-2020-12641](https://intel.threadlinqs.com/cve/CVE-2020-12641) — CRITICAL 9.8 · KEV · EPSS 93.1% · 2020-05-04 - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) — CRITICAL 9.9 · KEV · EPSS 91.6% · 2025-06-02 - [CVE-2023-5631](https://intel.threadlinqs.com/cve/CVE-2023-5631) — MEDIUM 6.1 · KEV · EPSS 83.4% · 2023-10-18 - [CVE-2024-42009](https://intel.threadlinqs.com/cve/CVE-2024-42009) — CRITICAL 9.3 · KEV · EPSS 83.4% · 2024-08-05 - [CVE-2023-43770](https://intel.threadlinqs.com/cve/CVE-2023-43770) — MEDIUM 6.1 · KEV · EPSS 80.4% · 2023-09-22 - [CVE-2020-35730](https://intel.threadlinqs.com/cve/CVE-2020-35730) — MEDIUM 6.1 · KEV · EPSS 64.8% · 2020-12-28 - [CVE-2021-44026](https://intel.threadlinqs.com/cve/CVE-2021-44026) — CRITICAL 9.8 · KEV · EPSS 64% · 2021-11-19 - [CVE-2025-68461](https://intel.threadlinqs.com/cve/CVE-2025-68461) — HIGH 7.2 · KEV · EPSS 6.8% · 2025-12-18 - [CVE-2026-48842](https://intel.threadlinqs.com/cve/CVE-2026-48842) — HIGH 8.1 · EPSS 0.1% · 2026-05-25 - [CVE-2026-48847](https://intel.threadlinqs.com/cve/CVE-2026-48847) — LOW 3.7 · EPSS 0.1% · 2026-05-25 - [CVE-2026-48844](https://intel.threadlinqs.com/cve/CVE-2026-48844) — HIGH 7.5 · EPSS 0% · 2026-05-25 - [CVE-2026-48848](https://intel.threadlinqs.com/cve/CVE-2026-48848) — HIGH 7.2 · EPSS 0% · 2026-05-25 - [CVE-2026-48849](https://intel.threadlinqs.com/cve/CVE-2026-48849) — MEDIUM 4.4 · EPSS 0% · 2026-05-25 - [CVE-2026-48845](https://intel.threadlinqs.com/cve/CVE-2026-48845) — MEDIUM 6.5 · EPSS 0% · 2026-05-25 - [CVE-2026-48846](https://intel.threadlinqs.com/cve/CVE-2026-48846) — MEDIUM 6.5 · EPSS 0% · 2026-05-25 - [CVE-2026-48843](https://intel.threadlinqs.com/cve/CVE-2026-48843) — HIGH 7.2 · EPSS 0% · 2026-05-25 ## Products affected Threadlinqs normalises CPE and CNA product records across all 16 CVEs; 1 distinct Roundcube product is affected. The most frequently affected: - Webmail — 16 CVEs ## Threat activity 10 tracked threat campaigns reference Roundcube products or exploit Roundcube CVEs: - [Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry](https://intel.threadlinqs.com/threat/TL-2026-2561) — CRITICAL — 2026-09-18 - [Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage Campaign Against Europe's Ukraine Defence Supply Chain](https://intel.threadlinqs.com/threat/TL-2026-2031) — HIGH — 2026-08-16 - [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)](https://intel.threadlinqs.com/threat/TL-2026-1987) — CRITICAL — 2026-08-11 - [Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)](https://intel.threadlinqs.com/threat/TL-2026-2579) — CRITICAL — 2026-07-23 - [UNK_MassTraction: China-Aligned Actor Exploits Roundcube CVE-2024-42009 & CVE-2025-49113 to Deploy IceCube Stealer and VShell Against University Physics Departments](https://intel.threadlinqs.com/threat/TL-2026-1259) — HIGH — 2026-07-13 - [UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers](https://intel.threadlinqs.com/threat/TL-2026-1162) — HIGH — 2026-07-10 - [Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432, CVE-2026-54433) — Versions Prior to 1.6.17 / 1.7.2](https://intel.threadlinqs.com/threat/TL-2026-1185) — HIGH — 2026-07-10 - [Roundcube Webmail Pre-Auth SQL Injection in virtuser_query Plugin (CVE-2026-48842) — Patched in 1.6.16 / 1.7.1 Alongside 7 Other Vulnerabilities](https://intel.threadlinqs.com/threat/TL-2026-0616) — HIGH — 2026-05-28 - [RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV)](https://intel.threadlinqs.com/threat/TL-2026-0130) — CRITICAL — 2026-02-22 - [APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)](https://intel.threadlinqs.com/threat/TL-2026-0066) — HIGH — 2026-02-12 ## Threat actors targeting Roundcube Named threat actors attributed to campaigns that involve Roundcube products or CVEs, with the number of linked campaigns: - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2 campaigns - [APT28](https://intel.threadlinqs.com/actor/APT28) — 2 campaigns - [APT38](https://intel.threadlinqs.com/actor/APT38) — 2 campaigns - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 2 campaigns - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 2 campaigns - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 2 campaigns - [UNK_MassTraction](https://intel.threadlinqs.com/actor/UNK_MassTraction) — 2 campaigns - [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 1 campaign - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 1 campaign ## How to prioritise Roundcube patching This order follows the data Threadlinqs holds for Roundcube, not a generic severity checklist: - 8 of 16 Roundcube CVEs (50%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2020-12641](https://intel.threadlinqs.com/cve/CVE-2020-12641), [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113), [CVE-2023-5631](https://intel.threadlinqs.com/cve/CVE-2023-5631). - Outside KEV, the highest EPSS scores are [CVE-2026-48842](https://intel.threadlinqs.com/cve/CVE-2026-48842) (0.1%), [CVE-2026-48847](https://intel.threadlinqs.com/cve/CVE-2026-48847) (0.1%), [CVE-2026-48844](https://intel.threadlinqs.com/cve/CVE-2026-48844) (0%). - 4 CVEs score Critical and 5 High on CVSS v3 (maximum 9.9, average 7.2); sequence these after KEV and high-EPSS items. - 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/roundcube All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp