On February 11, 2026, CISA added two critical vulnerabilities affecting the Roundcube Webmail platform to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws are being leveraged by threat actors to hijack email sessions and exfiltrate sensitive data.

The Vulnerabilities

• CVE-2025-23190: A high-severity Stored Cross-Site Scripting (XSS) vulnerability. Attackers can send a specially crafted email that, when viewed, executes malicious JavaScript in the victim’s browser to steal session cookies.
• CVE-2025-23191: A Command Injection flaw in the spell-check component. This allows authenticated users (or attackers who have stolen a session via the XSS flaw) to execute arbitrary commands on the underlying server.

Threat Actor Activity

The ESET Research team has attributed recent exploitation to Winter Vivern (also known as TA473). This group primarily targets:

• Governmental entities and military departments.
• European and Central Asian diplomatic organizations.
• Managed Service Providers (MSPs) using Roundcube for webmail hosting.

Required Action

Per Binding Operational Directive (BOD) 22-01, federal agencies and private organizations are urged to:

1. Update Immediately: Apply the latest security patches (Roundcube version 1.6.10 or 1.5.10) available via the Roundcube Downloads page.
2. Sanitize Content: Ensure the washtml cleaner is functioning correctly to block malicious SVG or HTML payloads.
3. Monitor Logs: Check for unusual shell activity stemming from the web server process (e.g., www-data or apache calling sh or bash).