What is the CVSS score of CVE-2026-54433?

CVE-2026-54433 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Roundcube are affected by CVE-2026-54433?

Roundcube Webmail versions 1.6.x (before 1.6.17) and 1.7.x (before 1.7.2) contain a critical vulnerability enabling attackers to inject scripts and hijack authenticated email sessions, resulting in…. A patch is available.

How to fix or mitigate CVE-2026-54433?

Within 24 hours, inventory all Roundcube Webmail deployments and identify systems running versions 1.6.x or 1.7.x. Within 7 days, upgrade all affected instances to Roundcube 1.6.17 or 1.7.2 respectively and verify deployment across the webmail infrastructure. Within 30 days, conduct an audit of email access logs and forwarding rules for unauthorized activity during the vulnerability window, and implement additional email access controls such as IP whitelisting or step-up authentication on webmail login.

Roundcube CVE-2026-54433

EUVD-2026-43732 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 vendor:ubuntu

GHSA-6hj3-f24f-rwj8

XSS Roundcube Webmail Suse

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered XSS with no attacker privileges; I assess UI:R because a webmail victim typically must view the crafted message, keeping S:C and Low C/I as the injected script runs in the authenticated origin.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 17, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Severity Changed

Jul 17, 2026 - 19:37 NVD

HIGH CRITICAL

CVSS changed

Jul 17, 2026 - 19:37 NVD

7.2 (HIGH) 10.0 (CRITICAL)

Patch available

Jul 14, 2026 - 18:20 EUVD

Analysis Updated

Jul 14, 2026 - 17:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 17:22 NVD

7.2 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:21 vuln.today

DescriptionNVD

[Unknown description]

AnalysisAI

Cross-site scripting in Roundcube Webmail 1.6.x (before 1.6.17) and 1.7.x (before 1.7.2) allows remote attackers to inject script that executes in a victim's authenticated webmail session, enabling session hijacking and mail data theft. The flaw is reported by the Ubuntu security team and has a vendor patch, but SSVC lists exploitation as none and there is no public exploit identified at time of analysis. EPSS is low at 0.28% (20th percentile), suggesting limited near-term mass exploitation despite the nominal CVSS 10.0.