ctrlINT What the industry said about every indicator, with the quote

CVE-2025-49113Vulnerability

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 7 independent sources · first reported by Recorded Future · last reported

Last reported 4 days ago

CISA KEVAdded 20 Feb 2026
Fix due 13 Mar 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS99.0%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

9 reports, newest first · the exact sentence from each

  1. “…tiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940), plus follow-on use of the Roundcube flaw CVE-2025-49113.”

    SOCRadarVendor
    INC and The Gentlemen Ransomware: Exposed AI Infrastructure

  2. “In February, CISA listed CVE-2025-49113 and CVE-2025-68461 as actively exploited Roundcube vulnerabilities.”

    Security AffairsNews
    Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild

  3. “They exploited CVE-2025-49113 in vulnerable Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”

    CERT-EUGovernment
    Cyber Brief 26-09 - August 2026

  4. “…0), WordPress (CVE-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-25257).”

    SOCRadarVendor
    Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry

  5. “Way back in February 2026, two other vulnerabilities in the same product (CVE-2025-49113 and CVE-2025-68461) were tagged as actively exploited by the U.S.”

    The Hacker NewsNews
    Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

  6. “CVE-2025-49113”

    Recorded FutureVendor
    August 2026 CVE Landscape

  7. “The group ran its infrastructure almost entirely on machines it did not own, using Roundcube webmail servers exploited through CVE-2025-49113 with credentials likely sourced from dark web leaks, alongside compromised PrestaShop sites.”

    Infosecurity MagazineNews
    Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day

  8. “Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers.”

    Check Point ResearchVendor
    Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

  9. “CVE-2025-49113”

    Recorded FutureVendor
    July 2026 CVE Landscape

Indicators reported together

named in the same reports

Also named with it: CVE-2026-68820, CVE-2026-33824, CVE-2026-63030, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-48842, CVE-2026-34486, CVE-2026-39987, CVE-2021-3156, CVE-2021-29441, CVE-2026-3055, CVE-2026-12569, CVE-2026-3395, CVE-2020-1472, CVE-2022-1040, CVE-2023-46747, CVE-2024-55591, CVE-2025-31324, CVE-2025-68461

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2025-49113 here?
No account needed. We do not store your IP address.