Detections
Analytics
Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities
critical Nessus Plugin ID 342614
Language:
Synopsis
An application running on the remote web server is affected by multiple vulnerabilities.Description
The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities:- The cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver. (CVE-2026-74997)
- Mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection. (CVE-2026-75002)
- Responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing. (CVE-2026-74998)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Roundcube Webmail version 1.6.18, 1.7.3 or later.See Also
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
Plugin Details
Severity: Critical
ID: 342614
File Name: roundcube_webmail_1_6_18.nasl
Version: 1.5
Type: Remote
Family: CGI abuses
Published: 9/3/2026
Updated: 9/11/2026
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.14
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-75003
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:roundcube:webmail
Required KB Items: installed_sw/Roundcube Webmail
Exploit Ease: No known exploits are available
Patch Publication Date: 8/9/2026
Vulnerability Publication Date: 8/9/2026
Reference Information
CVE: CVE-2026-74997, CVE-2026-74998, CVE-2026-74999, CVE-2026-75000, CVE-2026-75002, CVE-2026-75003, CVE-2026-75004, CVE-2026-75006, CVE-2026-75007, CVE-2026-75010