Security researcher Oren Yomtov tracked broken patches in webmail software, finding that incomplete fixes can turn into attack vectors.
The vulnerability or weakness
Roundcube, an open-source webmail software, had a server-side request forgery (SSRF) flaw (CVE-2026-35540) that was only partially addressed, leaving the underlying code vulnerable.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-21510 | 8.8 | HIGH | Yes, added 2026-02-10 | 2026-03-03 |
| CVE-2026-32202 | 4.3 | MEDIUM | Yes, added 2026-04-28 | 2026-05-12 |
| CVE-2026-35540 | 6.5 | MEDIUM | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using Roundcube could face data breaches and loss of user trust, impacting their operations and reputation.
Industries affected
The issue primarily affects organizations that use open-source webmail solutions, including educational institutions and small businesses.
Users affected
Users of Roundcube could have their personal data exposed, leading to privacy concerns and potential legal issues for the organizations they use.
Build these skills
Watch the daily brief
Sources
- Incomplete security patches show hackers where to look next (Help Net Security)
