Multiple vulnerabilities in Roundcube Webmail versions 1.6.x and

26 May 2026 high vulnerability

Multiple vulnerabilities in Roundcube Webmail versions 1.6.x and 1.7.x enable remote code execution, data confidentiality and integrity breaches, and SQL injection attacks.

The French CERT (CERT-FR) has published an advisory regarding multiple security vulnerabilities affecting Roundcube Webmail. The vulnerabilities impact versions 1.6.x prior to 1.6.16 and versions 1.7.x prior to 1.7.1. The disclosed flaws span several attack vectors including remote code execution, SQL injection, server-side request forgery (SSRF), and security policy bypass capabilities.

These vulnerabilities pose significant risks to organizations using affected Roundcube installations, potentially allowing attackers to compromise the confidentiality and integrity of email data, execute arbitrary code on vulnerable servers, and bypass implemented security controls. The combination of remote code execution with data exfiltration capabilities makes these vulnerabilities particularly concerning for webmail infrastructure.

Roundcube has released patched versions 1.6.16 and 1.7.1 to address these security issues. Organizations running affected versions should prioritize upgrading to the latest releases to mitigate these risks. The vendor published their security bulletin on May 24, 2026, providing detailed remediation guidance.

Detection guidance

Web Server Process Spawning Command Interpreter (Possible Roundcube RCE)

ATT&CK T1190

Detects a web server or PHP-FPM process spawning a shell or scripting interpreter, consistent with exploitation of a webmail RCE vulnerability such as those in Roundcube. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Interpreter
id: b63b35ce-0654-5092-9cf1-0727d4a013ac
status: experimental
description: Detects a web server or PHP process (apache, nginx, php-fpm, php-cgi)
  spawning a command shell or scripting interpreter, which can indicate exploitation
  of a web application vulnerability such as the Roundcube Webmail RCE flaws described
  in CERT-FR advisory.
references:
- CERT-FR advisory on Roundcube Webmail 1.6.x/1.7.x vulnerabilities
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - apache2
    - httpd
    - nginx
    - php-fpm
    - php-cgi
    - www-data
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python3
    - /perl
    - /php
    - /curl
    - /wget
    - /nc
  condition: selection_parent and selection_child
falsepositives:
- Legitimate PHP scripts invoking system utilities such as mail delivery agents or
  image processing tools
- Web application maintenance scripts intentionally shelling out for cron or backup
  tasks
level: high
tags:
- attack.t1190
- attack.t1059
author: Vorant

Webshell-like PHP File Written to Roundcube Web Directory

ATT&CK T1505.003

Detects creation of new PHP files within Roundcube webmail application directories, which may indicate a webshell dropped via an unauthenticated RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP File Created in Roundcube Web Directory
id: 8cf33e8f-f0e8-5816-828b-f1bb5cb0340b
status: experimental
description: Detects creation of new .php files inside typical Roundcube installation
  paths, which can indicate a webshell was dropped after exploitation of an RCE vulnerability
  such as those disclosed for Roundcube Webmail 1.6.x/1.7.x.
references:
- CERT-FR advisory on Roundcube Webmail 1.6.x/1.7.x vulnerabilities
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - /roundcube/
    - /webmail/
    TargetFilename|endswith: .php
  filter_known_paths:
    TargetFilename|contains:
    - /roundcube/vendor/
    - /roundcube/skins/
    - /roundcube/program/
    - /roundcube/plugins/
  condition: selection and not filter_known_paths
falsepositives:
- Legitimate Roundcube plugin installation or update writing new PHP files
- Administrator manually deploying custom plugins or skins
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Post-Exploitation Reconnaissance Commands from PHP Web Process

ATT&CK T1059

Detects execution of common reconnaissance or download commands (whoami, id, uname, wget, curl) spawned by a PHP or web server process, suggesting post-exploitation activity after a web application compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Reconnaissance Commands Executed by Web Server Process
id: 57e6e7d2-f241-5a7f-8034-f88c142aee0e
status: experimental
description: Detects reconnaissance or staging commands such as whoami, id, uname,
  wget, or curl launched with a web server or PHP process as parent, indicating possible
  post-exploitation activity following an RCE such as the Roundcube Webmail vulnerabilities.
references:
- CERT-FR advisory on Roundcube Webmail 1.6.x/1.7.x vulnerabilities
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - apache2
    - httpd
    - nginx
    - php-fpm
    - php-cgi
  selection_cmd:
    CommandLine|contains:
    - whoami
    - ' id '
    - uname -a
    - 'wget '
    - 'curl '
    - /etc/passwd
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or monitoring scripts executed through PHP that call system utilities
- Legitimate administrative scripts invoked via web-based control panels
level: medium
tags:
- attack.t1059
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0644

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free