Email, files and business apps

Roundcube Webmail security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 11 actively exploited security flaws for Roundcube Webmail, dated Nov 3, 2021 to Feb 20, 2026. Sources checked: the California and Washington Attorney General breach lists and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

None found in the sources we check.

Got a breach letter from Roundcube Webmail? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in Roundcube Webmail products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Feb 20, 2026Exploited flaw

   RoundCube Webmail Deserialization of Untrusted Data Vulnerability (CVE-2025-49113). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Feb 20, 2026Exploited flaw

   RoundCube Webmail Cross-site Scripting Vulnerability (CVE-2025-68461). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Jun 9, 2025Exploited flaw

   RoundCube Webmail Cross-Site Scripting Vulnerability (CVE-2024-42009). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Oct 24, 2024Exploited flaw

   RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2024-37383). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Jun 26, 2024Exploited flaw

   Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2020-13965). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Feb 12, 2024Exploited flaw

   Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-43770). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Oct 26, 2023Exploited flaw

   Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-5631). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

8. Jun 22, 2023Exploited flaw

   Roundcube Webmail Remote Code Execution Vulnerability (CVE-2020-12641). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

9. Jun 22, 2023Exploited flaw

   Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (CVE-2020-35730). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

10. Jun 22, 2023Exploited flaw

    Roundcube Webmail SQL Injection Vulnerability (CVE-2021-44026). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. Nov 3, 2021Exploited flaw

    Roundcube Webmail File Disclosure Vulnerability (CVE-2017-16651). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "Roundcube Webmail security incident history," vendorhistory.com/vendor/roundcube, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.