Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild
Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.
4
Stories per day · 30 days
1 RSS
8 stories, newest first · one card per story
Stories tagged #cve-2026-48842
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.
2
Roundcube SQLi (CVE-2026-48842) Exploited
Pre-authentication Roundcube Webmail SQL injection CVE-2026-48842 is reportedly exploited months after patches.
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
8
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
Unauthenticated SQL injection CVE-2026-48842 in Roundcube Webmail is being actively exploited on unpatched servers.
6
Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild
Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.
3
Roundcube security advisory (AV26-503) – Update 1
Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.