The US cybersecurity agency CISA on Friday warned of two RoundCube Webmail vulnerabilities being exploited in the wild. Prevalent within government and enterprise networks, RoundCube Webmail is a popular target for hackers, who have been observed exploiting flaws in the email client within days of public disclosure. This was the case in June last year with CVE-2025-49113 (CVSS score of 9.9), a post-authentication remote code execution (RCE) issue that was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on Friday. The critical bug was introduced over a decade ago and impacts all RoundCube versions 1.1.0 through 1.6.10, allowing attackers to include a payload in the name of files to be uploaded, leading to data being injected in the current session. The security defect was…