CVE-2026-48842

DiscoveredMay 25, 2026UpdatedSep 25, 2026

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

View graph Watch Export

CVSS v3.1

8.1 HIGH

EPSS

0.89%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 26, 2026

▲ 0.13pp

0.76% → 0.89% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

5 relationships

CWE-89

source

Timeline

disclosure → media coverage

May 25, 2026

Disclosure — published as a CVE record. · last revised by NVD Sep 25, 2026

Sep 24, 2026

bleepingcomputer.com reports: Hackers now exploit critical Roundcube flaw in code injection attacks

Sep 25, 2026

securityweek.com reports: Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Sep 25, 2026

thehackernews.com reports: Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Public PoC (3)

github.com/murrez/CVE-2026-48842 github.com/4minx/CVE-2026-48842 github.com/XsanFlip/POC-CVE-2026-48842

Unverified third-party code — review before executing.