Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Reported by SecurityWeek (Ionut Arghire)

Summary by Cyber Security News25 Sep 2026, 08:57 CEST

About this summary. This is a short, independently written summary of an article first published by SecurityWeek. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/

Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.

Read the full article at SecurityWeek →

Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Roundcube SQLi (CVE-2026-48842) Exploited

Roundcube security advisory (AV26-503) – Update 1

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)