Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Reported by The Hacker News ([email protected] (The Hacker News))

Summary by Cyber Security News25 Sep 2026, 12:14 CEST

About this summary. This is a short, independently written summary of an article first published by The Hacker News. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html

The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Roundcube SQLi (CVE-2026-48842) Exploited

Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Roundcube security advisory (AV26-503) – Update 1

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)