cve recordhighexploited in the wild

CVE-2025-49113

Roundcube · Webmail · RoundCube Webmail Deserialization of Untrusted Data Vulnerability

· Added to CISA KEV Feb 20, 2026

CVSS—

Severityhigh

Weakness—

ExploitedYes, in CISA KEV

Ransomware useUnknown

Federal fix dueMar 13, 2026

Description

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

← Back to the CVE Tracker

Our coverage of CVE-2025-49113

CVE-2026-68820Aug 12, 2026high

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The Lazarus Group, a North Korean state-sponsored hacking collective, has been linked to a sophisticated cyber espionage campaign dubbed Operation Dream Job. This campaign leverages a recently patched Windows zero-day vulnerability (CVE-2026-68820) to escalate privileges and deploy a new backdoor named Troy. The group targets defense and aerospace companies in France, Germany, Brazil, and India by impersonating recruiters on platforms like LinkedIn and offering fake job opportunities.

CVE-2008-4128Aug 7, 2026high

July 2026 CVE Landscape

In July 2026, a significant increase in high-impact vulnerabilities was observed, with 85 critical flaws identified, 36 of which had a Very Critical Recorded Future Risk Score. A notable portion of these vulnerabilities were either already listed in CISA's Known Exploited Vulnerabilities catalog or were reported by vendors. The vulnerabilities affected a wide range of products from 61 vendors, with Microsoft products being the most frequently impacted.

CVE-2024-42009Jul 7, 2026high

Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities

A China-aligned espionage group has been observed targeting U.S. and Canadian universities, specifically in physics and engineering departments. The attackers exploited two vulnerabilities in the Roundcube email client (CVE-2024-42009 and CVE-2025-49113) to steal credentials and establish persistent access through webshells and backdoors. Proofpoint researchers identified the campaign, which appears to be ongoing, and noted that victims may not yet be aware of the compromise.