Roundcube (Vendor): news timeline & CVEs

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.

The Canadian Centre for Cyber Security warned that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin, is being actively exploited. The CVSS 8.1 bug affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1 and comes from a preg_replace() backslash escape bypass that lets unauthenticated attackers inject SQL, potentially exposing mail credentials and stored messages. Roundcube patched it in May 2026. Shadowserver counted more than 523,000 internet-exposed Roundcube instances, with 10 flagged vulnerable as of September 23, 2026. Prior exploited Roundcube flaws include CVE-2025-49113 and CVE-2025-68461.

The Hacker NewsSep 25, 10:14 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-48842 CVE-2025-49113 CVE-2025-68461

Roundcube SQLi (CVE-2026-48842) Exploited

Pre-authentication Roundcube Webmail SQL injection CVE-2026-48842 is reportedly exploited months after patches.

SOCRadar reports that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail, is being exploited in the wild. The activity is described as occurring months after patches became available. The published notice does not identify affected versions, victims, or the scale of exploitation.

SOCRadarupdated Sep 25, 10:14 UTC · 1d agofirst Sep 25, 09:41 UTC · 2d agoExploit / PoC in the wild 6 sources CVE-2026-48842

Hackers now exploit critical Roundcube flaw in code injection attacks

Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.

The Canadian Centre for Cyber Security says CVE-2026-48842, a pre-authenticated SQL injection in Roundcube Webmail's virtuser_query plugin, is being exploited four months after its May patch. Unauthenticated attackers can bypass login, run database commands, and steal data from the Roundcube database. Fixes are in versions 1.6.16 and 1.7.1, while Shadowserver tracks more than 523,000 exposed instances. Earlier Roundcube bugs were used by Winter Vivern and APT28, and CISA has previously listed other Roundcube flaws as exploited.

BleepingComputerSep 24, 13:27 UTC · 2d agoExploit / PoC in the wildCVE-2026-48842 CVE-2023-5631 CVE-2020-35730+4 CVEs1

Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication

Unauthenticated SQL injection CVE-2026-48842 in Roundcube Webmail is being actively exploited on unpatched servers.

CVE-2026-48842 is an unauthenticated SQL injection in Roundcube Webmail’s virtuser_query plugin, caused by a bypass of backslash escaping in PHP preg_replace handling. It affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1; fixed versions were released on May 24, 2026. On September 21 the Canadian Centre for Cyber Security updated advisory AV26-503 to say open-source community reports show ongoing exploitation. A remote attacker can manipulate backend SQL before login, with impact depending on database privileges, so internet-facing servers should be patched and hunted immediately.

GBHackersupdated Sep 25, 10:14 UTC · 1d agofirst Sep 24, 09:56 UTC · 3d agoExploit / PoC in the wild 6 sources CVE-2026-488421

Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild

Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.

The Canadian Centre for Cyber Security says attackers are actively exploiting CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin. The flaw, caused by a backslash-escaping bypass in PHP preg_replace, affects versions before 1.6.16 and 1.7.1 and was fixed in advisories published on May 24, 2026. Advisory AV26-503 was updated on September 21, 2026, after open-source reporting confirmed exploitation. Unauthenticated attackers may manipulate database queries on exposed servers where the plugin is enabled.

Cyber Security Newsupdated Sep 25, 10:14 UTC · 1d agofirst Sep 24, 07:37 UTC · 3d agoExploit / PoC in the wild 6 sources CVE-2026-48842

Roundcube security advisory (AV26-503) – Update 1

Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.

The Canadian Centre for Cyber Security updated advisory AV26-503 on Roundcube Webmail vulnerabilities affecting versions before 1.6.16 and 1.7.1. The September 21, 2026 update says open-source reporting indicates CVE-2026-48842 is being exploited in the wild. The Cyber Centre urges users and administrators to review the linked advisories and install the fixes. The notice does not describe the vulnerability's impact or attack method.

Canadian Centre for Cyber Securityupdated Sep 25, 10:14 UTC · 1d agofirst Sep 21, 20:20 UTC · 5d agoExploit / PoC in the wild 6 sources CVE-2026-48842

North Korean Lazarus Group Uses Windows Zero

Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.

Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.

Security AffairsAug 13, 07:05 UTC · Aug 13, 2026Threat actor in the wildCVE-2026-68820 CVE-2025-491131

Roundcube

Timeline7 articles

Related CVEsby mentions

Appears with