CVE-2026-48842
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Early warning: exploitation observed
- Exploitation observed since Sep 21, 2026
- Not yet in the official CISA catalogue
- First attack observed 118 days after disclosure
Source: VulnCheck KEV · Sep 21, 2026 Sep 21, 2026
CVSS score8.1 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-89
Related articles
Active Roundcube Attacks Put Pre-Login SQL Injection at the Top of Patch Queues
Attackers exploit CVE-2026-48842, a pre-auth Roundcube SQL injection. Learn affected versions 1.6.x, 1.7.x and how to patch now.
Roundcube Servers Face Active Attacks Through Pre-Login Database Injection
Roundcube CVE-2026-48842 is under active exploit, enabling pre-login SQL injection via virtuser_query. Patch to 1.6.16 or 1.7.1 immediately.
This product uses the NVD API but is not endorsed or certified by the NVD.