Back to Security Advisories

Roundcube security update 1.6.20 is not yet available in cPanel & WHM: Roundcube vulnerabilities prior to version 1.6.20

Roundcube released security update 1.6.20 on October 19, 2026, fixing vulnerabilities in versions prior to 1.6.20 and 1.7.5. cPanel has now shipped the updated Roundcube in cPanel & WHM versions 110.0.154, 134.0.67, 136.0.51 and 138.0.19 — update your server with sudo /scripts/upcp --force and confirm the Roundcube version afterwards.

High
cPanel

Affected Versions

1.6.20

What this means under a SharedLicense license

The flaws affect Roundcube webmail itself — the application every mail user on the server touches — so unpatched servers leave a known-vulnerable webmail application exposed to their customers and the internet.

Symptoms

Roundcube released a security update on October 19th, 2026 in v1.6.20.

Cause

Roundcube versions prior to 1.6.20 and 1.7.5 have security vulnerabilities, and an internal case, CPANEL-57939, has been opened for the development team to review and address this.

Resolution

At this time, this security update is now available in the following cPanel versions:

110.0.154

134.0.67

136.0.51

138.0.19

To receive this update, please upgrade to the latest patched version: How do I update cPanel/WHM?

Frequently Asked Questions

What is the Roundcube 1.6.20 security update?
It is Roundcube's October 19, 2026 security release fixing vulnerabilities in versions prior to 1.6.20 and 1.7.5. cPanel tracked the gap under internal case CPANEL-57939 and has now shipped the updated Roundcube across its release branches.
Which cPanel versions include the fixed Roundcube?
cPanel & WHM 110.0.154, 134.0.67, 136.0.51 and 138.0.19 — run sudo /scripts/upcp --force to reach the latest build for your release tier, then verify the Roundcube version in Webmail or WHM.
Is this related to the Plesk Roundcube advisory?
Yes — the same Roundcube 1.6.20 security release that Plesk bundled in Obsidian 18.0.81.5. The Roundcube vulnerabilities affect the application regardless of panel; each panel ships the fixed 1.6.20 through its own update channel.
What if my server cannot update cPanel yet?
The vulnerability lives in Roundcube, not cPanel core — as a stopgap you can restrict webmail access (firewall or VPN rules) until the upcp update is applied. The permanent fix remains updating cPanel to a build with Roundcube 1.6.20.

References

Security Advisories

Related Advisories

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System