CVE-2026-35537

low-risk
Published 2026-04-03

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Roundcube

References (8)

Patch https://github.com/roundcube/roundcubemail/commit/618c5428edc69fb088e7ac6c89e506...
Patch https://github.com/roundcube/roundcubemail/commit/6d586cfa4d8a31f7957f7a445aaedd...
Patch https://github.com/roundcube/roundcubemail/commit/a4ead994d2f0ea92e4a1603196a197...
Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.5.14
Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
Release Notes https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
Third Party Advisory https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
Issue Tracking http://www.openwall.com/lists/oss-security/2026/04/11/6
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal