Security1 hSeptember 28, 2026, 12:50

Roundcube SQL injection CVE-2026-48842 exploited in the wild

Canada's Centre for Cyber Security warned on September 21 that CVE-2026-48842 (CVSS 8.1) in Roundcube is being exploited in the wild. The pre-auth SQL injection in the virtuser_query plugin affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1; the fix shipped on May 24, 2026.

Security Affairs

Open source

CVE-2026-48842 (CVSS 8.1) is a pre-auth SQL injection in the virtuser_query plugin
Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 are vulnerable; patch out May 24
Exploitation requires no account or user interaction
Successful attacks can expose mailbox credentials and stored messages

#Roundcube

CVE-2026-75682 in Adobe Connect: SQL injection rated 9.9 leads to code execution

Security

CVE-2026-76461: SQL injection in Cisco email gateway grants root

Security

Metabase CVE-2026-72898: unauthenticated SQL injection exposes the data warehouse

Security

Roundcube SQL injection CVE-2026-48842 exploited in the wild

CVE-2026-75682 in Adobe Connect: SQL injection rated 9.9 leads to code execution

CVE-2026-76461: SQL injection in Cisco email gateway grants root

Metabase CVE-2026-72898: unauthenticated SQL injection exposes the data warehouse

Cisco FMC SQL injection CVE-2026-20344: monitoring plan