CVE-2024-42009

LLM-synthesized narrative grounded in this CVE's description and references.

• Roundcube/Webmail

  cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

  Range: <1.5.8
• Roundcube/Roundcubemailcpe-rescue2 versions

  (expand)+ 1 more

  • (no CPE)
  • (no CPE)range: <=1.5.7 or 1.6.x <=1.6.7
• osv-coords5 versions

  pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Tumbleweedpkg:rpm/suse/roundcubemail&distro=SUSE%20Package%20Hub%2015%20SP5pkg:rpm/suse/roundcubemail&distro=SUSE%20Package%20Hub%2015%20SP6

  < 1.6.8-bp156.2.3.1+ 4 more

  • (no CPE)range: < 1.6.8-bp156.2.3.1
  • (no CPE)range: < 1.6.8-bp156.2.3.1
  • (no CPE)range: < 1.6.8-1.1
  • (no CPE)range: < 1.6.8-bp156.2.3.1
  • (no CPE)range: < 1.6.8-bp156.2.3.1

• roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8nvdVendor Advisory
• sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/nvdTechnical DescriptionThird Party Advisory
• github.com/roundcube/roundcubemail/releasesnvdRelease Notes
• github.com/roundcube/roundcubemail/releases/tag/1.5.8nvdRelease Notes
• github.com/roundcube/roundcubemail/releases/tag/1.6.8nvdRelease Notes
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

• Suspected Chinese snoops caught breaking into universities' Roundcube mailservers
  The Register Security · Jul 8, 2026
• Hackers exploit Roundcube flaw to spy on academic researchers
  BleepingComputer · Jul 8, 2026
• Hackers Exploit Roundcube N-Day Flaws to Steal Credentials and Deploy VShell
  Cyber Security News · Jul 8, 2026
• Chinese Cyberespionage Exploits University Roundcube Servers
  GovInfoSecurity · Jul 7, 2026
• Suspected Chinese Threat Group Targets Universities via Vulnerable Roundcube Servers
  Infosecurity Magazine · Jul 7, 2026
• Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
  The Hacker News · Jul 7, 2026
• Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities
  CyberScoop · Jul 7, 2026
• Russian Threat Groups Use RDP, VPN, Supply Chain Attacks, and Social Engineering for Initial Access
  Cyber Security News · May 22, 2026
• Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike
  The Hacker News · May 14, 2026