Roundcube webmail disclosed multiple critical vulnerabilities including unauthenticated
Roundcube webmail disclosed multiple critical vulnerabilities including unauthenticated remote code execution and SQL injection, patched in versions 1.6.16 and 1.7.1.
On May 24, 2026, Roundcube published an advisory addressing multiple security vulnerabilities in their webmail application. The vulnerabilities include remote arbitrary code execution and unauthenticated SQL injection, representing significant risks to organizations running vulnerable versions. These flaws could allow attackers to compromise webmail servers without requiring valid credentials, potentially leading to unauthorized access to email communications and server takeover.
The French CERT (CERT-FR) has highlighted these vulnerabilities in their weekly bulletin as significant security issues requiring immediate attention. Organizations are advised to upgrade to the patched versions 1.6.16 or 1.7.1 to mitigate these risks. The combination of unauthenticated access and code execution capabilities makes these vulnerabilities particularly dangerous for internet-facing Roundcube installations.
Given the widespread use of Roundcube in enterprise and government environments, these vulnerabilities pose risks across multiple sectors. The availability of patches indicates that exploitation details may become public, increasing the urgency for organizations to apply updates promptly.
Detection guidance
Web Server Process Spawning Command Interpreter (Possible Roundcube RCE)
Detects a web server or PHP-FPM process spawning a shell/command interpreter, consistent with exploitation of Roundcube unauthenticated RCE vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Interpreter
id: 831caa4a-9373-5f41-8981-2b60205b1d00
status: experimental
description: Detects a web server or PHP process (apache, nginx, php-fpm) spawning
a shell interpreter such as sh, bash, cmd.exe or powershell, which is consistent
with exploitation of Roundcube remote code execution vulnerabilities disclosed in
the May 2026 advisory.
references:
- https://cert.fr
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- php-fpm
- php
- apache2
- httpd
- nginx
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
filter:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter
falsepositives:
- Legitimate PHP scripts that shell out to system utilities for mail delivery or attachment
processing
- Custom webmail plugins invoking external binaries as part of normal operation
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant
Web Shell File Dropped in Roundcube Webroot
Detects creation of PHP files in Roundcube application directories such as temp, logs, or plugin folders, which may indicate a web shell dropped following exploitation of an unauthenticated RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Dropped in Roundcube Webroot
id: 48dec24d-afab-52d9-969f-a0e160bd272e
status: experimental
description: Detects creation of new PHP files within Roundcube's writable directories
(temp, logs, plugins) which is a common post-exploitation step after abusing the
unauthenticated code execution vulnerability in Roundcube webmail.
references:
- https://cert.fr
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- /roundcube/temp/
- /roundcube/logs/
- /roundcube/plugins/
TargetFilename|endswith: .php
filter:
TargetFilename|contains:
- index.php
- config.php
condition: selection and not filter
falsepositives:
- Legitimate Roundcube plugin installation or update activity by administrators
- Automated deployment scripts writing configuration or cache PHP files
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
Reconnaissance Commands Executed via Web Server Child Process
Detects common reconnaissance commands (whoami, id, uname, wget, curl) executed as children of web server or PHP processes, indicating possible post-exploitation activity after a web application compromise such as Roundcube RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reconnaissance Commands Executed via Web Server Child Process
id: 3dcac9ed-7726-5d63-bed8-f334a03eb2c5
status: experimental
description: Detects execution of common reconnaissance or download utilities (whoami,
id, uname, wget, curl) spawned by a web server or PHP process, which is a typical
indicator of successful exploitation of a public-facing web application such as
Roundcube.
references:
- https://cert.fr
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- php-fpm
- php
- apache2
- httpd
- nginx
Image|endswith:
- /whoami
- /id
- /uname
- /wget
- /curl
condition: selection
falsepositives:
- Monitoring or health-check scripts that call system information binaries from web
application code
- Legitimate plugins that fetch remote resources using curl or wget
level: medium
tags:
- attack.t1059
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-024
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free