CVE-2026-35544 Roundcube CVE debrief

Who should care

Users of Roundcube Webmail, particularly those using versions before 1.5.14 and 1.6.14, should be aware of this vulnerability and take steps to mitigate it. This includes administrators of Roundcube Webmail instances, security teams monitoring for potential exploitation attempts, and operators responsible for applying patches or updates.

Technical summary

The vulnerability exists due to insufficient CSS sanitization in HTML e-mail messages in Roundcube Webmail before versions 1.5.14 and 1.6.14. This could allow an attacker to bypass a fixed-position mitigation using the !important directive. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.3, indicating a medium severity level. Affected users should prioritize updating to the latest versions or applying patches to mitigate this vulnerability.

Defensive priority

Medium priority should be given to updating Roundcube Webmail to versions 1.5.14 or 1.6.14, or applying the necessary patches to mitigate this vulnerability.

Recommended defensive actions

• Update Roundcube Webmail to version 1.5.14 or 1.6.14.
• Apply patches from commits 099009b9c8e1d3c636fb9a5af72f7c2596018662, 226811a1c974271dbedca72672923abaff8191c0, and 57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7.
• Review and implement additional security measures to detect and prevent exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information can be found in the vendor's advisory and release notes for versions 1.5.14, 1.6.14, and 1.7-rc5. The evidence is limited to publicly available information and may not reflect the full scope of affected systems or potential impacts.

Official resources