Vulnerabilities

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

September 25, 2026 1 min read 4 views
cybersecurity threats news
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash

Was this article helpful?

0 found this helpful

Related Articles

Jev and other decision models can still be tricked with prompt injection

3 min read

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

1 min read

Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

1 min read

Ready to protect your organization?

Get started with Phishlens and run your first phishing simulation today.

Schedule a Demo