Vulnerability intelligence
CVE-2026-48842
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
CVSS Score
8.1
High
EPSS — Exploit Probability
0.9%
Riskier than 59% of all CVEs · checked 2026-10-24
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
6 articles across 4 outlets · first covered May 28, 2026 · latest Oct 4, 2026
Coverage timeline
RSS-
Attackers Exploit Roundcube Webmail Flaw to Steal Mailbox Datasecurityaffairs.com · Sep 28, 2026
-
Nine Flaws Exploited as Attackers Target Edge Products and WordPresssecurityonline.info · Sep 28, 2026
-
Roundcube SQL Flaw Exploited in Attacks Against Webmail Serverssocradar.io · Sep 25, 2026
-
Hackers Exploit Roundcube SQL Flaw to Target Webmail Serverswww.securityweek.com · Sep 25, 2026
-
Actively Exploited Roundcube Flaw Exposes Email Databases to Attackerssecurityonline.info · Sep 24, 2026
-
Roundcube fixes critical SQL injection and code injection bugssecurityonline.info · May 28, 2026