Vulnerabilities
Multiple Roundcube Flaws Expose Webmail Servers to RCE, SSRF, and Privilege Escalation
Roundcube Webmail has released critical updates patching several security vulnerabilities affecting 1.6.x and 1.7.x release lines. The flaws expose systems to remote code execution, server-side request forgery, privilege escalation, and cross-site scripting. Administrators are urged to update to Roundcube versions 1.6.18 or 1.7.3 immediately.
Critical Flaws Discovered in Roundcube Webmail
Maintainers of the Roundcube webmail client have issued security patches addressing a cluster of vulnerabilities that pose severe risks to mail server deployments. The security flaws allow attackers to perform remote code execution, trigger server-side request forgery (SSRF), escalate privileges, and bypass standard security policies.
Impact and Vulnerability Breakdown
Exploitation of these weaknesses could enable unauthorized attackers to gain unauthorized access to mail servers, compromise data confidentiality, and execute arbitrary code within target environments.
The advisory covers multiple tracking identifiers, including CVE-2026-74997, CVE-2026-74998, CVE-2026-74999, CVE-2026-75000, CVE-2026-75002, CVE-2026-75004, CVE-2026-75006, CVE-2026-75007, and CVE-2026-75010.
Affected Systems and Patch Guidance
Organizations running self-hosted Roundcube installations are advised to check their active versions. The impacted software versions include:
- Roundcube Webmail 1.6.x releases prior to version 1.6.18
- Roundcube Webmail 1.7.x releases prior to version 1.7.3
System administrators should apply the patches by updating installations to Roundcube 1.6.18 or 1.7.3 to prevent potential exploitation.
Related vulnerabilities
Fortinet Issues Mass Security Fixes for RCE and Privilege Escalation Vulnerabilities
Fortinet has released updates resolving multiple security vulnerabilities across its product portfolio, including FortiOS, FortiManager, and FortiAnalyzer. Successful exploitation could allow remote code execution, privilege escalation, and denial-of-service attacks. Network administrators should patch affected installations promptly.
Read briefing
HPE Aruba SD‑WAN Products Hit by Multiple Remote Code Execution and Privilege‑Escalation Flaws
HPE Aruba Networking has disclosed a set of critical flaws in its EdgeConnect SD‑WAN Gateways and Orchestrator that can be exploited for remote code execution, privilege escalation, and denial‑of‑service. Affected releases include Gateway 9.4.x‑9.7.x (pre‑9.4.9.0, 9.5.9.0, 9.6.4.0, 9.7.1.0) and Orchestrator 9.4.x‑9.7.x (pre‑9.4.11, 9.5.9, 9.6.4, 9.7.1.0). The CVE list ranges from CVE‑2024‑32664 to CVE‑2026‑76696. Patch the firmware immediately and follow HPE’s advisory for configuration hardening.
Read briefing
Ivanti Connect Secure & Policy Secure Gateways Hit by Multi‑Vulnerability Surge – Patch Now
A wave of critical flaws—CVE‑2024‑22024, CVE‑2024‑21888, CVE‑2024‑21893, CVE‑2023‑46805, CVE‑2024‑21887—has been actively exploited against Ivanti Connect Secure and Policy Secure Gateways. The bugs enable unauthenticated privilege escalation, SSRF, and remote code execution, letting attackers hijack devices and steal credentials. Ivanti released patches for most affected versions in February, with additional fixes rolled out through March. Immediate patching, re‑authentication, and hardened configuration are essential to stop attackers from leveraging these weaknesses.
Read briefing
Cisco Contact Center SSRF Vulnerability (CVE‑2026‑20314) Requires Authenticated Access
Cisco’s Packaged and Unified Contact Center Enterprise (CCE) software contains a server‑side request forgery flaw that can be leveraged by anyone who has valid credentials on the system. The defect arises from lax validation of HTTP requests, allowing attackers to instruct the affected device to issue arbitrary outbound traffic. Cisco has released patches to fix the issue; no workarounds are available. Organizations running CCE must apply the update immediately to stop potential internal network reconnaissance and data exfiltration.
Read briefing