Roundcube security advisory (AV26-503) – Update 1
Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.
The Canadian Centre for Cyber Security updated advisory AV26-503 on Roundcube Webmail vulnerabilities affecting versions before 1.6.16 and 1.7.1. The September 21, 2026 update says open-source reporting indicates CVE-2026-48842 is being exploited in the wild. The Cyber Centre urges users and administrators to review the linked advisories and install the fixes. The notice does not describe the vulnerability's impact or attack method.
- CVE-2026-48842 in Roundcube Webmail is reportedly exploited in the wild.
- Vulnerable versions are those before 1.6.16 and before 1.7.1.
- Canada's Cyber Centre urges administrators to review links and patch.
- CVEs
- CVE-2026-48842
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-503 Date: May 25, 2026 Updated: September 21, 2026 On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product: Roundcube Webmail – versions prior to 1. 6. 16 Roundcube Webmail – versions prior to 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.