The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) Roundcube Webmail vulnerabilities, CVE-2025-49113 and CVE-2025-68461, to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed active exploitation and directed all Federal Civilian Executive Branch (FCEB) agencies to remediate affected systems by no later than March 13, 2026. CVE-2025-49113 is a critical remote code execution (RCE) flaw stemming from unsafe deserialization and improper validation of the “_from” parameter within upload functionality, enabling authenticated attackers to execute code and posing elevated risk given its presence in the codebase for over a decade and reliable exploitation on default installations. Researchers reported that threat actors rapidly reverse engineered and weaponized the vulnerability within forty-eight (48) hours of disclosure, with exploit code quickly appearing for sale, while internet scanning has identified tens of thousands of publicly exposed Roundcube instances potentially at risk. The second vulnerability, CVE-2025-68461, is a lower-complexity cross-site scripting (XSS) flaw leveraging SVG animate tag abuse that can be exploited remotely by unauthenticated attackers. Although attribution for current activity has not been disclosed, Roundcube has historically been targeted by both cybercriminal and state-sponsored threat actors, including APT28 and Winter Vivern, which previously exploited Roundcube XSS vulnerabilities in espionage campaigns against European and Ukrainian government entities, reinforcing concerns that widely deployed webmail platforms remain high-value initial access and persistence vectors. CTIX analysts urge any affected administrators to follow the Roundcube guidance and patch the flaw before the CISA deadline to prevent exploitation.