<![CDATA[🟠 High: Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild]]>

<![CDATA[🟠 High: Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild]]>The Canadian Centre for Cyber Security has issued a warning about a Roundcube Webmail vulnerability that has been patched but is now being actively exploited in the wild.

The flaw is tracked as CVE-2026-48842 with a CVSS score of 8.1. It is a pre-authentication SQL injection in the virtuser_query plugin, affecting:

Roundcube Webmail 1.6.x before 1.6.16
Roundcube Webmail 1.7.x before 1.7.1

The issue stems from a preg_replace() backslash problem in the plugin's handling, which enables the injection before authentication occurs. Since the vulnerability can be triggered without valid credentials, any exposed instance running an affected version should be considered at risk.

If you run Roundcube, verify your version and upgrade to 1.6.16, 1.7.1, or a later release as soon as possible. Given that exploitation is confirmed in the wild, patching should be treated as urgent, and administrators should review logs for signs of suspicious requests to the virtuser_query endpoint.

Source: The Hacker News

Has your organization already patched Roundcube, or are you still assessing exposure?

]]>https://xploitlk.com/topic/470/high-roundcube-pre-auth-sql-injection-flaw-actively-exploited-in-the-wildRSS for NodeTue, 27 Oct 2026 10:36:45 GMTSat, 26 Sep 2026 06:30:22 GMT60