Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Summary: The Canadian Centre for Cyber Security warned that CVE-2026-48842, a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, is being actively exploited in the wild, citing open-source reporting. The flaw, rated CVSS 8.1, stems from a preg_replace() backslash escape bypass that lets unauthenticated attackers inject SQL into the database backend, and patches shipped in May 2026.
Why it matters: Shadowserver data shows more than 523,000 Roundcube instances exposed to the internet, and this is the third Roundcube flaw in 2026 tied to active exploitation, following CISA's February tagging of CVE-2025-49113 and CVE-2025-68461 and Proofpoint's July report on a suspected China-aligned adversary using Roundcube bugs to deliver web shells.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-49113CVE-2025-68461CVE-2026-48842
- Related
- ⚡ Weekly Recap: Chrome 0-Day, Data Wipers, Misused Tools and Zero-Click iPhone Attacks Cyber Risks ·CVE-2025-68461: Round Cube Webmail Cross-site Scripting Vulnerability Known Exploited Vulnerabilities · Feb 20, 2026CVE-2025-49113: Round Cube Webmail Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Feb 20, 2026