Roundcube Webmail before 1.6.20 and 1.7.5 has security flaws
Original title: Roundcube security advisory (AV26-1075)
Canadian advisory AV26-1075 names the fixed releases but gives no CVE identifiers or impact details.
The Canadian Centre for Cyber Security issued AV26-1075 on October 22, 2026, stating that as of October 19 Roundcube Webmail before 1.6.20 and before 1.7.5 is affected by vulnerabilities. It directs users and administrators to Roundcube's security updates 1.6.20 and 1.7.5. The bulletin does not name the flaws, CVE identifiers or any exploitation status.
Unconfirmed: The advisory does not describe the vulnerabilities or say whether they are being exploited.
- Affected ranges are prior to 1.6.20 and prior to 1.7.5.
- The corresponding security updates are 1.6.20 and 1.7.5.
- The notice is serial number AV26-1075.
| Product | Affected | Fixed in |
|---|---|---|
| Roundcube Webmail | Prior to 1.6.20 | 1.6.20 |
| Roundcube Webmail | Prior to 1.7.5 | 1.7.5 |
- 1.Apply Roundcube security updates 1.6.20 and 1.7.5.
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1075 Date: October 22, 2026 As of October 19, 2026, Roundcube is affected by vulnerabilities in the following product: Roundcube Webmail Prior to 1. 6. 20 Prior to 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.