CVE-2026-48842

High8.1Published on May 25, 2026

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

Early warning: exploitation observed

Exploitation observed since Sep 21, 2026
Not yet in the official CISA catalogue
First attack observed 118 days after disclosure

Source: VulnCheck KEV · Sep 21, 2026 Sep 21, 2026

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-89

Vulnerabilities

Roundcube Servers Face Active Attacks Through Pre-Login Database Injection

Roundcube CVE-2026-48842 is under active exploit, enabling pre-login SQL injection via virtuser_query. Patch to 1.6.16 or 1.7.1 immediately.

Sep 24, 202615:535 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Roundcube Servers Face Active Attacks Through Pre-Login Database Injection