CVE-2026-114724 | Roundcube Webmail up to 1.6.19/1.7.4 Session unserialize deserialization

October 22, 2026 Yanac

A vulnerability classified as critical was found in Roundcube Webmail up to 1.6.19/1.7.4. The impacted element is the function rcube_session::unserialize of the component Session. The manipulation results in deserialization.

This vulnerability is cataloged as CVE-2026-114724. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More