medium
advisory
Roundcube Webmail Security Updates
Roundcube has released security updates for Roundcube Webmail versions prior to 1.6.20 and 1.7.5 to address undisclosed vulnerabilities.
Triage facts
Revision 1- Applicability
- Roundcube Webmail (< 1.6.20), Roundcube Webmail (< 1.7.5)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 29, 19:48 UTC
- Source quality
- A1Roughly even chance
The Cyber Centre reported that Roundcube released versions 1.6.20 and 1.7.5 on October 19, 2026, to address security vulnerabilities affecting Roundcube Webmail. The specific nature of the vulnerabilities remains undisclosed by the vendor at this time. Administrators are encouraged to apply these updates to all instances of Roundcube Webmail.
Recommendation
- Inventory all instances of Roundcube Webmail within the environment to identify versions older than 1.6.20 or 1.7.5.
- Upgrade all identified Roundcube Webmail instances to version 1.6.20 or 1.7.5 immediately upon verifying stability in a test environment.
Immediate actions
Inventory and patch Roundcube Webmail instances
IT Operations
48h
Mitigations
Upgrade Roundcube Webmail to version 1.6.20 or 1.7.5
immediate
IT Operations
Roundcube Webmail versions < 1.6.20 and < 1.7.5