Security Advisory

CVE-2026-74997

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-17 12:37:45

Last updated 2026-08-17 14:34:26

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

← Browse all CVEs View on cve.org ↗