CVE-2026-74997: OS Command Injection
Published Aug 17, 2026
·Updated
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver.
Affected Software
1 affected component
Roundcube Roundcube Webmail<1.6.18, >1.6.18<1.7.3, >=1.7.0<=1.7.2
Event History
Aug 17, 2026
CVE Published
via MITRE·12:37 PM
Data Sourced
via MITRE·12:37 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-74997?
CVE-2026-74997 has a severity rating of 8.8, indicating a high risk level.
2
How do I fix CVE-2026-74997?
To fix CVE-2026-74997, you should update Roundcube Webmail to version 1.6.18 or 1.7.3 or later.
3
What types of attacks are possible with CVE-2026-74997?
CVE-2026-74997 allows for remote code execution due to OS command injection vulnerabilities.
4
Which versions of Roundcube are affected by CVE-2026-74997?
CVE-2026-74997 affects Roundcube Webmail versions prior to 1.6.18 and 1.7.x before 1.7.3.
5
What plugin is vulnerable in CVE-2026-74997?
The cmd_learn driver of the markasjunk plugin is the component that is vulnerable in CVE-2026-74997.