Back to CVE records Critical 9.8 Known exploited (CISA KEV) Published Nov 18, 2021
CVE-2021-44026 Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Updated under an hour ago (Oct 28, 2026, 10:00 AM ET )
It affects roundcube webmail and 2 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jun 22, 2023; federal agencies had to remediate by Jul 13, 2023. Treat that date as your deadline.
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Know when a CVE hits your systems
Subscribers record the products they run, or their organization's HealthData DueCare inventory is used automatically, and every matching CVE is emailed as it is published.
CVSS 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Known exploited Added to CISA KEV Jun 22, 2023; federal remediation due Jul 13, 2023Apply updates per vendor instructions. EPSS (exploitation in the next 30 days) 69.88% (percentile 99)
Record last updated Oct 21, 2025
First seen by InfoSec Signals Oct 9, 2026 Affected products Product Versions Per before 1.3.17; from 1.4.0 before 1.4.12
NVD 33; 34
NVD 9.0; 10.0; 11.0
NVD
References Reference Tags https://bugs.debian.org/1000156 x-refsource-misc, mailing-list, patch https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 x-refsource-misc, patch https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa x-refsource-misc, patch https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/ vendor-advisory, x-refsource-fedora, mailing-list, release-notes https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/ vendor-advisory, x-refsource-fedora, mailing-list, release-notes https://www.debian.org/security/2021/dsa-5013 vendor-advisory, x-refsource-debian, third-party-advisory https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html mailing-list, x-refsource-mlist, third-party-advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44026 us-government-resource
The CVE record on cve.org · NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
