Today's cybersecurity headlines are brought to you by ThreatPerspective

CISA Warns of Active Exploitation of Roundcube Webmail Flaws

CISA has issued a warning about two critical vulnerabilities in the Roundcube webmail platform, which have been actively exploited by threat actors. The U.S. government's cybersecurity agency has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they pose significant risks to federal agencies and other organizations that use the platform.

The first vulnerability, CVE-2025-49113, is a critical remote code execution flaw that was patched in June 2025. Despite being fixed, threat actors have been exploiting this vulnerability days after it was patched, according to Internet security watchdog Shadowserver. The agency has tracked over 84,000 vulnerable Roundcube webmail installations worldwide.

The second vulnerability, CVE-2025-68461, is a remote, unauthenticated cross-site scripting (XSS) attack that can be exploited through low-complexity attacks on the animate tag in SVG documents. Roundcube patched this vulnerability in December 2025 and released versions 1.6.12 and 1.5.12 to address the security flaw.

CISA has warned that these vulnerabilities are frequent attack vectors for malicious cyber actors, posing significant risks to federal agencies and other organizations that use Roundcube webmail. The agency has ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems against these security bugs within three weeks, by March 13.