CVE-2025-49113

RoundCube Webmail is the web-based system many businesses use to read and send emails. This flaw can let someone who is already logged in use a specially crafted link to trick the server into running attacker code.

Think of it like a “logged-in guest” leaving a hidden switch on your building’s electrical panel—if they can reach it, they can potentially cause serious damage.

This matters if your business runs RoundCube Webmail (webmail) and it’s installed in a vulnerable version prior to the fixed releases. Because the attacker must be authenticated, the risk is mainly about stolen or valid webmail logins being used against you.

It’s a risk when the vulnerable RoundCube Webmail version is reachable by a user who can successfully log in (for example, via your normal webmail sign-in page).

This is RED because confirmed guidance from CISA places CVE-2025-49113 in its KEV catalog, meaning it is expected to be actively relevant. Attackers only need an authenticated session, so any exposed or compromised webmail credentials become a direct path to full server compromise.

You should treat the due date in CISA KEV (2026-03-13) as the timeline to complete remediation.