CVE-2026-48842
CVSS 8.1 HIGH: roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the… EPSS 2% (77th percentile).
Vulnerabilities · 48 days ago
The Canadian Centre for Cyber Security says Roundcube Webmail flaw CVE-2026-48842 is being exploited in the wild, and the bug is unauthenticated. Roundcube fixed it in 1.6.16 and 1.7.1.
CVSS 8.1 HIGH: roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the… EPSS 2% (77th percentile).
3 sources covering this story
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube's patched CVE-2026-48842 SQL injection is actively exploited, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.
Part of the PlainSec briefing for 2026-09-28