#roundcube

Analysis · Jun 19, 2026 · Colten Anderson

A 6.1 read European government email for two years

Two medium-severity Roundcube XSS bugs let Russian state actors read government email with no click required. The CVSS score said monitor. The KEV listing said move.