CVE-2026-48842
CVSS 8.1 HIGH: roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the… EPSS 2% (77th percentile).
Vulnerabilities & Exploits · Web App Attack
The Canadian Centre for Cyber Security says Roundcube Webmail flaw CVE-2026-48842 is being exploited in the wild, and the bug is unauthenticated. Roundcube fixed it in 1.6.16 and 1.7.1.
3 sources · Sep 25
CVSS 8.1 HIGH: roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the… EPSS 2% (77th percentile).
The Hacker News
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube's patched CVE-2026-48842 SQL injection is actively exploited, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
originalSecurityWeek
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.
originalBleepingComputer
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.
originalPart of the PlainSec briefing for 2026-09-24
Every edition of this story: Roundcube SQL injection hits before login