Patch now! Roundcube mail servers are being actively exploited

CISA warns that Roundcube Webmail has a persistent XSS vulnerability (CVE-2023-43770) actively exploited in the wild; affected versions (pre-1.4.14, pre-1.5.4, pre-1.6.3) should be updated to patched releases (1.6.3 and later). The agency added the flaw to its Known Exploited Vulnerabilities Catalog and mandates remediation for federal agencies by March 4, 2024; roughly 132,000 Roundcube servers are internet-accessible, increasing potential impact as attackers can store and serve malicious payloads via email.