Risk Letters

Exploited vulnerability

CVE-2026-48842

TLP:CLEAR

Roundcube Webmail Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

Facts

  • Vendor: Roundcube
  • Product: Roundcube Webmail
  • CVSS: 8.1
  • EPSS (probability of exploitation within 30 days): 1.7 %
  • First known exploitation: 21 September 2026
  • First seen by Risk Letters: 26 May 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD