{"id":"CVE-2021-44026","published":"2021-11-19T04:15:07Z","modified":"2026-06-17T04:11:48Z","title":"Roundcube Webmail SQL Injection Vulnerability","vendor":"Roundcube","product":"Roundcube Webmail","tier":"core","eol":null,"description":{"text":"Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.","provenance":"source","from":"NVD"},"summary":{"text":"Roundcube Webmail, in versions before 1.3.17 and 1.4.x before 1.4.12, contains an SQL injection flaw in how the search and search_params parameters are handled. An attacker who can reach the webmail interface over the network can exploit it without authentication or user interaction, potentially affecting the confidentiality, integrity, and availability of the underlying database.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:17Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.69882,"percentile":0.9937,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-06-22","dueDate":"2023-07-13","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released; https://nvd.nist.gov/vuln/detail/CVE-2021-44026","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-06-20","exploitedFirstSeen":"2023-06-20","ransomware":false,"evidence":[{"url":"https://cert.gov.ua/article/4905829","date":"2023-06-20"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2023-0620.pdf","date":"2023-06-20"},{"url":"https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers","date":"2023-06-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-06-22"},{"url":"https://redalert.nshc.net/blog/","date":"2024-05-29"},{"url":"https://redalert.nshc.net/2024/07/29/2023-activities-summary-of-sectorc-groups-jpn/","date":"2024-07-29"},{"url":"https://www.maverits.com/post/apt28-the-long-hand-of-russian-interests","date":"2025-01-25"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a","date":"2025-05-21"},{"url":"https://www.logpoint.com/en/blog/frontline-intel-pinpointing-grus-ttps-in-the-recent-campaign/","date":"2025-05-22"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://bugs.debian.org/1000156","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/","tags":["Mailing List","Release Notes"]},{"url":"https://www.debian.org/security/2021/dsa-5013","tags":["Third Party Advisory"]},{"url":"https://bugs.debian.org/1000156","tags":["Mailing List","Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/","tags":["Mailing List","Release Notes"]},{"url":"https://www.debian.org/security/2021/dsa-5013","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44026","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: public-facing webmail parameter injection","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"is prone to a potential SQL injection via search or search_params","start":48,"end":113}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SQL injection executes attacker-supplied database commands","mappingType":"primary_impact","evidence":[{"from":"description","quote":"is prone to a potential SQL injection via search or search_params","start":48,"end":113}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-30885","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30885","exploited":true,"exploitedSince":"2023-06-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-04-02","earliestUrl":"https://github.com/shanglyu/roundcube-cve-2021-44026","repos":[{"name":"shanglyu/roundcube-cve-2021-44026","url":"https://github.com/shanglyu/roundcube-cve-2021-44026","stars":0,"created":"2025-04-02"},{"name":"skyllpro/CVE-2021-44026-PoC","url":"https://github.com/skyllpro/CVE-2021-44026-PoC","stars":0,"created":"2025-04-20"}]},"first":{"date":"2025-04-02","source":"PoC-in-GitHub","url":"https://github.com/shanglyu/roundcube-cve-2021-44026"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-11-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44026","provenance":"source"},{"date":"2023-06-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cert.gov.ua/article/4905829","provenance":"source"},{"date":"2023-06-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-06-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30885","provenance":"source"},{"date":"2025-04-02","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/shanglyu/roundcube-cve-2021-44026","provenance":"source"}],"speed":{"daysToPublicExploit":1230,"firstExploitFrom":"PoC-in-GitHub","daysToKev":580},"priority":{"score":69.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1228 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9937"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}