$ cve CVE-2021-44026 JSON

CVE-2021-44026 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 69.9% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2023-07-13.

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	69.88% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-89
On CISA KEV	yes — remediate by 2023-07-13
Public exploit	none known
Published	2021-11-19
Last modified	2026-06-17

Name	Roundcube Webmail SQL Injection Vulnerability
Added	2023-06-22
Due	2023-07-13
Vendor / product	Roundcube / Roundcube Webmail
Ransomware use	none reported