Fixed Intel

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Mar 13, 2026

CVE-2025-68461

High
EPSS 6.3%CISA KEV
Roundcube/Webmail

Description

RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

EPSS — Exploit Probability

6.3%

Higher than 90.8% of all CVEs

Required Action

https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 ; https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb ; https://nvd.nist.gov/vuln/detail/CVE-2025-68461

Related Articles (1)

Vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

Feb 20, 2026

Risk Assessment

ELEVATED
In CISA KEV

Details

Severity
High
EPSS
6.3%
CISA KEV
Yes
Ransomware
Unknown
Articles
1

Timeline

Published

Feb 20, 2026

Added to KEV

Feb 20, 2026

Remediation Due

Mar 13, 2026

Affected Product

Roundcube

Webmail

View all Roundcube CVEs

External Links

NVD (NIST)CVE DetailsMITRE CVE