CISA Adds Actively Exploited Roundcube Flaws to KEV Catalog

CISA Adds Actively Exploited Roundcube Webmail Flaws to KEV Catalog

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities in Roundcube webmail, CVE-2023-5631 and CVE-2023-5632, to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
• CVE-2023-5631 is a cross-site scripting (XSS) vulnerability that could allow remote code execution (RCE) in specific environments, triggered by crafting a malicious SVG image or sending an email with a specially crafted link.
• These flaws impact Roundcube versions 1.6.x before 1.6.6, 1.5.x before 1.5.6, and 1.4.x before 1.4.14, with CISA mandating federal agencies to patch these vulnerabilities by March 4, 2026.

Source: The Hacker News | Date: February 12, 2026

References

1. CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog - The Hacker News
2. U.S. CISA adds RoundCube Webmail flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
3. CISA Adds Two Known Exploited Vulnerabilities to Catalog - CISA
4. CVE-2023-5631 Entry - NVD/MITRE
5. CVE-2023-5632 Entry - NVD/MITRE