CVE-2026-74997

Executive Summary

CVE-2026-74997 is an OS command injection vulnerability in the Roundcube Webmail markasjunk plugin, specifically in its cmd_learn driver. An authenticated, low-privileged user can achieve remote code execution on the underlying mail server by supplying crafted placeholder replacement values that are interpolated into a shell command without sanitization. The flaw affects Roundcube Webmail instances before 1.6.18 and 1.7.x before 1.7.3 running the markasjunk plugin with the cmd_learn driver; impact is full server compromise with a CVSS score of 8.8, and no patch evidence from tracked sources has been identified at the time of writing.

Technical Analysis

The vulnerability is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command. The markasjunk plugin provides the ability for a mailbox user to flag messages as spam or junk. Within this plugin, the cmd_learn driver is a backend implementation that executes an external, command-line based spam-learning utility rather than using IMAP flags exclusively. The NVD description states that the flaw manifests via "crafted placeholder replacement values," which indicates the following mechanism at the class level:

1. Command template construction. The cmd_learn driver assembles an OS command string that contains placeholders. These placeholders are intended to be substituted at runtime with values that define the learning operation — such as the mailbox identity, message identifiers, or other session-derived data.
2. Unsafe substitution. The replacement values are inserted into the command template and the resulting string is interpreted by a system shell (e.g., /bin/sh -c). If a value is not sanitized or shell-escaped prior to substitution, an attacker who controls that value can terminate the intended command context and append arbitrary shell syntax.
3. Injection primitive. Because the value flows into a shell context, standard command injection payloads — semicolons (;), logical operators (&&, ||), pipes (|), backticks (`), command substitution ($(...)), and variable expansion (${...}) — can be used to execute arbitrary operating system commands.

The attack surface is limited but significant. The NVD description explicitly states the issue "only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver." This means deployments where the plugin is disabled, removed, or configured with a different driver are not exposed to this specific defect. No specific file paths, function names, HTTP endpoints, or command-line utility names are disclosed in the NVD description, and the CNA Title is empty; therefore, the precise code-level details of the vulnerable routine cannot be confirmed from authoritative public data. The description is sufficient, however, to establish that user-influenced data reaches a placeholder inside a command string and that the substitution is performed insecurely.

The privilege requirement for this vulnerability is low (PR:L). An attacker must be able to authenticate to the Roundcube instance as a regular mailbox user. No user interaction beyond the attacker's own actions is required (UI:N). The attack is network-based (AV:N), requires no special conditions or race to exploit (AC:L), and does not cross security boundaries (S:U). The resulting compromise yields high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with full command execution in the context of the web server process.

Exploitation Scenarios

No public proof-of-concept or exploit code has been identified for CVE-2026-74997, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The following attack chain is therefore inferred from the vulnerability class and the component identifiers disclosed in the NVD description.

Step 1 — Reconnaissance and target identification. The attacker identifies Roundcube Webmail instances exposed to the internet. Roundcube login pages are readily fingerprintable via the generator meta tag in the login page HTML, HTTP response headers, favicon hash, and predictable /index.php or mail application URL patterns. The attacker further determines whether the target runs a vulnerable version (< 1.6.18 or 1.7.0–1.7.2). Presence of the markasjunk plugin and the active driver selection is not externally observable in most configurations, so the attacker may validate plugin presence by enabling the "report as junk" action and observing client-side behavior, or by testing a benign learn request after authentication.

Step 2 — Authentication and triggering the vulnerable component. The attacker obtains a low-privileged mailbox account, either through legitimate registration (where enabled), credential phishing, credential stuffing against the webmail login, or by compromising an existing mailbox. After authentication, the attacker marks or reports a message as junk/spam. This action causes the markasjunk plugin to invoke its cmd_learn driver, which performs the spam-learning operation via an OS command.

Step 3 — Payload delivery and execution. The attacker supplies a crafted value that will be used as a placeholder replacement during command assembly. Because the exact injection point is not publicly documented, the attacker would fuzz user-controllable fields that plausibly flow into the command template — message sender addresses, recipient addresses, subject lines, mailbox/folder names, or message headers. The crafted value contains shell metacharacters and an arbitrary command payload, e.g., a semicolon followed by a command that writes a web shell to the web root, establishes a reverse shell, or executes a command to exfiltrate data. When the value is substituted into the placeholder, the assembled string is passed to the operating system shell, and the injected command executes with the privileges of the web server/PHP process.

Step 4 — Post-exploitation impact. With code execution in the web server context, the attacker typically can:

• Read the Roundcube configuration to obtain database credentials and mail server credentials.
• Dump mailbox data, credentials, and session tokens.
• Deploy persistent access mechanisms such as backdoored PHP scripts or cron jobs.
• Pivot to the underlying mail store, IMAP/SMTP services, Identity Provider (LDAP/AD), or other systems reachable from the mail server.
• Use the compromised mail infrastructure to send phishing or spam, damaging domain reputation.

Impact Assessment

CVE-2026-74997 carries a CVSS v3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector: Network (N) — exploitable remotely over the internet.
• Attack Complexity: Low (L) — no special conditions or race conditions required.
• Privileges Required: Low (L) — any authenticated Roundcube mailbox user is sufficient.
• User Interaction: None (N) — the attacker does not need to trick another user.
• Scope: Unchanged (U) — impact is contained to the vulnerable webmail host.
• Confidentiality/Integrity/Availability: High (H/H/H) — full read/write/execute capability in the context of the web server.

Business impact is severe for organizations that self-host Roundcube Webmail. Email is a business-critical system; a full compromise of the webmail server exposes the contents of all mailboxes, credentials, and internal communications, and introduces a high risk of lateral movement into directory services and internal networks. Regulatory exposure includes breach notification obligations under GDPR, HIPAA, or other applicable regimes if personal or protected data is exfiltrated. The absence of confirmed patch data (patch confidence 0/4) means affected organizations may remain exposed for a prolonged window, elevating the urgency of mitigation. EPSS has not yet scored this CVE, so exploitation likelihood cannot be statistically benchmarked at this time.

Detection Guidance

The following detection content targets the only known component identifiers disclosed in the NVD description — the strings cmd_learn and markasjunk — combined with the generic OS command injection primitive (shell metacharacters in command lines or web requests). Until the precise injection channel is publicly documented, these rules are experimental and should be tuned to local baselines.

Sigma Rule

title: Roundcube markasjunk cmd_learn Driver OS Command Injection (CVE-2026-74997)
id: 8b0c0e2a-4f57-4b3a-9d2c-1a6c8f74d912
status: experimental
description: >
  Detects process creation events where the web server/PHP process spawns a child
  process whose command line references the Roundcube markasjunk plugin or its
  cmd_learn driver and contains shell metacharacters consistent with OS command
  injection (CWE-78).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74997
author: Valtersit Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php'
      - '/php-cgi'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_plugin:
    CommandLine|contains:
      - 'cmd_learn'
      - 'markasjunk'
  selection_injection:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '|'
      - '`'
      - '$('
      - '${'
  condition: selection_parent and selection_plugin and selection_injection
  level: high
falsepositives:
  - Legitimate manual command execution from a web-shell-like PHP process
  - Spam-filter learning invoked with shell constructs for legitimate configuration
  - Low prevalence expected; tune per-environment command-line baselines

YARA Rule

rule CVE_2026_74997_Roundcube_cmd_learn_Injection {
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects HTTP request payloads or log artifacts referencing the Roundcube markasjunk cmd_learn driver combined with OS command injection metacharacters"
        cve         = "CVE-2026-74997"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-74997"
        cwe         = "CWE-78"
    strings:
        $a = "cmd_learn" ascii wide nocase
        $b = "markasjunk" ascii wide nocase
        $c = /[;|&`]\s*(?:id|whoami|uname|bash|sh|curl|wget|nc|python|perl|php|cat|echo)\b/ ascii nocase
        $d = /\$\{[A-Z_]{1,16}\}|[`][^`]{1,256}[`]|\$\([^)]{1,256}\)/ ascii nocase
    condition:
        (any of ($a, $b)) and any of ($c, $d)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Roundcube markasjunk cmd_learn OS Command Injection Attempt (CVE-2026-74997)"; flow:established,to_server; content:"cmd_learn"; nocase; http_uri; pcre:"/(?:[;&|`]|\$\(|\$\{)[^\r\n]{0,256}(?:id|whoami|uname|bash|sh|curl|wget|nc|python|perl|cat|echo)/i"; classtype:attempted-admin; reference:cve,2026-74997; sid:202674997; rev:1; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

Elastic Detection

process where process.parent.name in ("php-fpm", "php", "php-cgi", "apache2", "httpd", "nginx")
  and process.command_line regex~* "cmd_learn|markasjunk"
  and process.command_line regex~* "[;&|`$]|\\$\\{|\\$\\("

This EQL query matches child processes spawned from a web-server PHP process where the command line references the known vulnerable plugin components and contains shell metacharacters or command substitution patterns. It assumes Elastic Endpoint or Auditbeat process event collection. Tune the parent process list to local web server names.

Splunk SPL Query

(index=linux sourcetype=linux_audit OR index=windows sourcetype=WinEventLog:Security)
  (CommandLine="*cmd_learn*" OR CommandLine="*markasjunk*")
  (CommandLine="*;*" OR CommandLine="*&&*" OR CommandLine="*||*" OR CommandLine="*|*" OR CommandLine="*`*" OR CommandLine="*$(*" OR CommandLine="*${*")
  (ParentImage="*php*" OR ParentImage="*apache*" OR ParentImage="*httpd*" OR ParentImage="*nginx*")
| table _time, host, src_ip, user, ParentImage, CommandLine
| sort - _time

Alternative: monitor the web layer for injection patterns referencing the plugin component:

index=web OR index=proxy
  "cmd_learn" (";" OR "%3B" OR "&&" OR "%26%26" OR "`" OR "%60" OR "$(" OR "%24%28" OR "${")
| table _time, src_ip, dest_ip, method, uri_path, http_user_agent

Wazuh OSSEC Rule

<group name="web,roundcube,">
  <rule id="100749" level="12">
    <if_group>web|apache|php</if_group>
    <match>cmd_learn</match>
    <regex>(\||;|&amp;&amp;|`)\s*(id|whoami|uname|bash|sh|curl|wget|nc|python|perl|cat|echo)</regex>
    <description>Possible OS command injection via Roundcube markasjunk cmd_learn driver (CVE-2026-74997)</description>
    <group>cve-2026-74997,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Deploy this rule in the Wazuh manager's local ruleset and feed it with web server access logs and/or audit daemon logs. Adjust the if_group to match the active log pipeline. The regex intentionally requires both the plugin component name and command-injection syntax to reduce false positives.

Mitigation & Patch Guidance

Patch confidence for CVE-2026-74997 is 0/4 — UNPATCHED according to all tracked patch sources; no vendor advisory, commit, or release note has been correlated by the tracking source at the time of writing. The NVD description itself implies that Roundcube Webmail versions 1.6.18 and 1.7.3 close the gap (as the issue exists "before" those versions), but no patch evidence has been confirmed from an independent tracking source. Administrators should proceed as if the vulnerability is fully unpatched and exposed.

1) Immediate mitigations

• Disable the markasjunk plugin entirely if it is not essential to business operations. Since the NVD description states the flaw is specific to the plugin's cmd_learn driver, removing or disabling the plugin eliminates the attack surface.
• If the plugin must remain enabled, reconfigure the plugin so that the cmd_learn driver is not selected; the description confirms other driver configurations are outside the affected scope.
• Restrict access to the Roundcube webmail interface to trusted networks via VPN or IP allow-listing where operationally feasible, reducing the remote attack surface.
• Monitor web and process logs for the detection patterns above, especially any occurrence of cmd_learn accompanied by shell metacharacters.

2) Patch / upgrade steps

• Upgrade Roundcube Webmail to version 1.6.18 or 1.7.3 (or later) as soon as those builds are released and validated in a staging environment. Validate plugin compatibility with the upgraded version before full deployment.
• Re-audit the environment after upgrade to confirm the markasjunk plugin and its driver configuration are as intended.
• If the vendor releases an advisory or backported security patch for older supported branches, apply it immediately and record the change in the change-management process.

3) Long-term hardening

• Run the web server/PHP-FPM process under a dedicated, least-privileged OS account with no write access to the web root and restricted filesystem access.
• Segment the webmail server from the corporate network; restrict outbound egress so that even successful exploitation has limited lateral movement options.
• Enforce multi-factor authentication on webmail accounts to reduce the likelihood of legitimate-account compromise that could be used as the "low privilege" prerequisite of this CVE.
• Maintain a patching SLA for internet-facing infrastructure; subscribe to Roundcube security announcements and re-check this CVE's status (EPSS, vendor advisory, CISA KEV) on a regular cadence.
• Audit any existing Roundcube logs for pre-compromise indicators; if evidence of exploitation is found, treat the host as fully compromised and perform incident response procedures, including credential rotation for connected mail and directory services.

References

1. NVD Entry — CVE-2026-74997: https://nvd.nist.gov/vuln/detail/CVE-2026-74997
2. MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
3. Roundcube Webmail Project — official site and download/security announcements: https://roundcube.net
4. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-74997 is NOT listed as of this writing)

No vendor advisory, researcher blog, or exploit-in-the-wild evidence for CVE-2026-74997 was identified in the provided data. No threat actor campaigns have been publicly attributed to this vulnerability at the time of writing. EPSS has not yet scored this CVE; organizations should treat this vulnerability as a high-priority unpatched exposure given its network reachability and low privilege requirement.