Is CVE-2026-114724 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114724 being exploited in the wild.

How severe is CVE-2026-114724?

High severity, with a CVSS score of 7.4, published 22 October 2026.

Which products and versions are affected?

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5.

Is there a fix for CVE-2026-114724?

Yes: fixed in Roundcube Webmail 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114724 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114724?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114724: Roundcube Webmail object injection in session unserialization

CVE-2026-114724 · Severity: high · CVSS 7.4 · Published 2026-10-22

Roundcube Webmail is a web-based email client used by organizations and individuals to access email remotely. A flaw in how the application processes session data allows an attacker with the ability to modify stored session information to inject malicious PHP objects, which could lead to remote code execution or data theft. An attacker would need access to the session storage mechanism to exploit this vulnerability.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-114724 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114724 being exploited in the wild.
How severe is CVE-2026-114724?: High severity, with a CVSS score of 7.4, published 22 October 2026.
Which products and versions are affected?: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5.
Is there a fix for CVE-2026-114724?: Yes: fixed in Roundcube Webmail 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114724 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114724?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Roundcube Webmail 1.6.20, 1.7.5

Technical details

The vulnerability is a PHP object injection primitive in the rcube_session::unserialize() method. Session keys prefixed with "!" are treated as having no value; the reconstructed serialized string is then emitted with a key but no corresponding value, causing the remainder of the input to be desynchronized so that following session data is interpreted as a serialized value. An attacker able to influence stored session data can craft a malicious payload to instantiate arbitrary PHP objects, potentially achieving remote code execution. The fix rejects session keys with the "!" prefix.

Affected products

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5

Timeline

2026-10-22: disclosed
2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.