Is CVE-2026-62643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62643 being exploited in the wild.

How severe is CVE-2026-62643?

High severity, with a CVSS score of 7.2, published 14 July 2026.

Which products and versions are affected?

Roundcube Webmail < 1.6.17, 1.7.x < 1.7.2.

Is there a fix for CVE-2026-62643?

A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62643 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-62643?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62643: Roundcube Webmail SSRF via insufficient CSS sanitization

Q: Which products and versions are affected?

Roundcube Webmail < 1.6.17, 1.7.x < 1.7.2.

Q: Is there a fix for CVE-2026-62643?

A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62643 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-62643?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62643 · Severity: high · CVSS 7.2 · Published 2026-07-14

Roundcube Webmail, a popular open-source web-based email client, is vulnerable to a security flaw in how it handles HTML email messages. An attacker can send a specially crafted email that forces the server to make unauthorized requests to internal network resources or disclose sensitive information. This could allow an attacker to probe private internal networks that are otherwise inaccessible from the internet.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-62643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62643 being exploited in the wild.
How severe is CVE-2026-62643?: High severity, with a CVSS score of 7.2, published 14 July 2026.
Which products and versions are affected?: Roundcube Webmail < 1.6.17, 1.7.x < 1.7.2.
Is there a fix for CVE-2026-62643?: A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62643 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62643?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail versions prior to 1.6.17 and 1.7.2. The issue stems from insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages, specifically failing to block stylesheet links pointing to local network hosts. An unauthenticated remote attacker can exploit this by sending a malicious HTML email containing crafted CSS URLs. Successful exploitation allows the attacker to perform internal network scanning or trigger unauthorized requests from the mail server. This vulnerability is a bypass of previous fixes for CVE-2026-35540 and CVE-2026-48843. Patches are available in versions 1.6.17 and 1.7.2.

Affected products

Roundcube Webmail < 1.6.17, 1.7.x < 1.7.2

Timeline

2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
2026-07-14: disclosed: CVE-2026-62643 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.