Roundcube Webmail

The Canadian Centre for Cyber Security published four security advisories on 2026-07-10 covering critical vulnerabilities in Roundcube Webmail, Broadcom/VMware Tanzu products, Microsoft Edge, and Bitwarden Server. The most urgent advisory (AL25-007 Update 1) confirms ongoing exploitation of CVE-2024-42009 and CVE-2025-49113 in Roundcube Webmail, where attackers first obtain valid credentials via CVE-2024-42009 and then leverage CVE-2025-49113 (a Post-Auth RCE via PHP Object Deserialization) to achieve remote code execution. Both CVEs are listed in CISA's KEV catalog, and a proof-of-concept exists for CVE-2025-49113.