CVE-2026-48842

Published May 25, 2026

Last updated a month ago

CVSS high 8.1
Roundcube Webmail
Open source
SQL injection

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48842 describes a pre-authentication SQL injection vulnerability affecting Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. The flaw is specifically located within the `virtuser_query` plugin and can be exploited by bypassing a `preg_replace()` backslash escape. This CVE was recently published to the CVE List and added to the NVD dataset on May 25, 2026.

Description
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.9
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

cve@mitre.org
CWE-89

Social media

Hype score
Not currently trending

  1. Roundcube webmail servers are now an exploitation target. CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin. Specially crafted backslash sequences can bypass escaping and inject SQL without authentication. The Canadian Centre for Cyber Security

    @LandscapeThreat

    30 Sept 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨‼️ALERT @roundcube SQL injection CVE-2026-48842 is now being exploited in the wild A Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVSS score of 8.1) and patched four months ago, is now being exploited in the wild. #cybersecurity https://t.co/kCN8uOFPlJ

    @solminingpunk

    28 Sept 2026

    276 Impressions

    1 Retweet

    6 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. 🚨 #ALERT — ROUNDCUBE CVE-2026-48842 PRE-AUTH SQL INJECTION REPORTED EXPLOITED IN THE WILD September 21, 2026 DISCLOSED BY: Roundcube PRODUCT: Roundcube Webmail CVE: CVE-2026-48842 AFFECTED VERSIONS: Roundcube 1.6.x before 1.6.16 Roundcube 1.7.x before 1.7.1 IMPACT:

    @Python_s_

    28 Sept 2026

    63 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 https://t.co/ZUeBbwsH4G

    @compuchris

    26 Sept 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CISO Daily Briefing: Patch now — F5 BIG-IP APM RCE (CVE-2026-94127), Roundcube pre-auth SQLi (CVE-2026-48842), WordPress RCE (CVE-2026-87902) weaponized within hours — all under active exploitation. NIST IR 8587 finalizes token-forgery rules; 78% of orgs still lack any AI-age

    @cloudsa

    26 Sept 2026

    382 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Roundcube-Lücke CVE-2026-48842: Fix seit 24. Mai, Angriffe seit ein paar Tagen. Dazwischen vier Monate. Webmail ist Software, die niemand installiert hat und für die sich niemand zuständig fühlt. https://t.co/l2UJLISO1p

    @cyberdine_ch

    26 Sept 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 Unpatched Roundcube servers are now being targeted. ⚠️ Attackers are exploiting CVE-2026-48842 against vulnerable Roundcube email servers, turning an unpatched webmail system into a potential entry point. 🎯 Roundcube servers targeted ⚠️ CVE-2026-48842 exploited

    @xcademialtd

    26 Sept 2026

    35 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Roundcube Webmail vulnerability CVE-2026-48842 is under active attack. Organizations relying on it should apply updates without delay. See https://t.co/YGPNdY0mFz for help. via SecurityWeek #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/eRwoIVUu1a

    @ADKCyber

    26 Sept 2026

    34 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 🚨 #ALERT — ROUNDCUBE PRE-AUTH SQL INJECTION REPORTED EXPLOITED IN THE WILD DATE: September 21, 2026 CONFIRMED BY: Canadian Centre for Cyber Security acknowledged open-source reports of in-the-wild exploitation. PRODUCT: Roundcube Webmail CVE: CVE-2026-48842 AFFECTED

    @Python_s_

    25 Sept 2026

    25 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 🚨 Roundcube Webmail pre-auth SQL injection (CVE-2026-48842) exploited in the wild Critical Vulnerability Alert! Roundcube Webmail is affected by CVE-2026-48842. 🔍 Identify Targets via ZoomEye: Search Dork: app="Roundcube Webmail" Exposure: 650.1k instances identified

    @zoomeyebot

    24 Sept 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Critical Roundcube flaw CVE-2026-48842 is being actively exploited in the wild, enabling pre-auth SQL injection via virtuser_query and possible auth bypass. #Roundcube #Canada #CVE-2026-48842 https://t.co/csad9zgZMd

    @TweetThreatNews

    24 Sept 2026

    191 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  12. CVE-2026-48842: 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849:Critical Roundcube Webmail Security Updates Fix Severe Flaws 📊 2.6M+ Services are found on the yearly. 🔗Hunter Link: 👇Query…

    @lyrie_ai

    8 Jun 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  13. ⚠️ Vulnerabilidades en productos Roundcube ❗ CVE-2026-48848 ❗ CVE-2026-48844 ❗ CVE-2026-48842 ➡️ Más info: https://t.co/YJE7XaZV9p https://t.co/SiNDcHSZ7h

    @CERTpy

    2 Jun 2026

    138 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Roundcube 1.6.16 öncesi ve 1.7.1 öncesi sürümleri etkileyen yüksek CVSS skorlu Güvenlik Açıkları duyuruldu. SQL Injection ve RCE riski var. Roundcube sürümünüzü 1.7.1 veya 1.6.16 sürümlerinden birine güncelleyin. CVE: CVE-2026-48842 CVE-2026-48843 CVE-2026-48848

    @ridvanyagli

    29 May 2026

    280 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849 :Critical Roundcube Webmail Security Updates Fix Severe Flaws 📊 2.6M+ Services are found on the https://t.co/ysWb28BTvF yearly. 🔗Hunter Link:https://t.co/BZe1fAjhlA 👇Query HUNTER : https://t

    @HunterMapping

    29 May 2026

    4824 Impressions

    16 Retweets

    71 Likes

    33 Bookmarks

    0 Replies

    1 Quote

  16. NEW THREAT INTEL: Roundcube pre-auth SQLi CVE-2026-48842 (8.1) - preg_replace bypass on cPanel/Plesk. Patch 1.6.16/1.7.1. https://t.co/sbGDi4V5d6 #ThreatIntel #SQLi https://t.co/Q8ovD0ZcAR

    @threadlinqs

    28 May 2026

    84 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. ⚠️⚠️ CVE-2026-48842 (CVSS 8.1) + CVE-2026-48844 (CVSS 7.5): Pre-auth SQLi in Roundcube virtuser_query plugin; patch to 1.6.16 / 1.7.1. 🔗FOFA Link: https://t.co/rcDbcVQvxt 🎯1.1M+ Results are found on https://t.co/NBEEGu7ePJ in the past year. FOFA Query: app="Roundcub

    @fofabot

    28 May 2026

    10733 Impressions

    29 Retweets

    130 Likes

    73 Bookmarks

    1 Reply

    0 Quotes

  18. Roundcube Webmailに深刻な脆弱性。CVE-2026-48842はCVSSスコア8.1のSQLインジェクション。preg_replaceでのバックスラッシュエスケープの回避に起因。CVE-2026-48844はCVSSスコア7.5で、LDAP autovalueからのコードインジェクション

    @__kokumoto

    28 May 2026

    772 Impressions

    1 Retweet

    6 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.•CVE-2023-54400
  2. Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.•CVE-2023-54399
  3. Cisco Secure Email Gateway SQL Injection Vulnerability•CVE-2026-76461
  4. GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability•CVE-2026-85706
  5. Metabase SQL Injection Vulnerability•CVE-2026-72898

References

Sources include official advisories and independent security research.