Roundcube vulnerabilities prior to version 1.6.14.

Symptoms

On March 18th 2026, Roundcube released a security update including versions 1.6.14 and 1.5.14. cPanel uses the 1.6 branch on all supported cPanel versions, and we have reported this to our development team who are working on updating the cPanel Roundcube package to 1.6.14 to address this.

Description

We've opened an internal case for our development team to investigate this further. For reference, the case number is SEC-71567. Follow this article to receive an email notification when a solution is published in the product. 

Workaround

When an updated package is released it will be installed automatically when the cPanel update script runs. Information about the Roundcube announcement can be found below:

Roundcube.net: Security updates 1.7-rc5, 1.6.14 and 1.5.14 released