CyberSecurity News

Roundcube Webmail Vulnerability in Attackers’ Crosshairs

SecurityWeek

· September 25, 2026

AI summary

A vulnerability in Roundcube Webmail is being targeted by attackers, identified as CVE-2026-48842. This bug is an SQL injection that can be exploited without the need for authentication.

Vulnerabilities mentioned

CVE-2026-48842

HIGH

CVSS 8.1

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

Read the full article at SecurityWeekwww.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to SecurityWeek.