CyberStack 
https://cyberstack.org/n/cve-2026-48842
Vulnerability
Published 2026-05-24
Updated 2026-11-03
Verified 2026-11-03

Roundcube Webmail CVE-2026-48842 (CVSS 8.1): pre-auth SQLi in virtuser_query — reportedly exploited, Singapore CSA says

Roundcube security updates 1.6.16 / 1.7.1 (published 24 May 2026) fix CVE-2026-48842: pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass (reporter: skull). Affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 when the plugin is enabled/reachable. The CVE record gives CVSS 3.1 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Same releases also fix XSS/CSS injection, SSRF/local URL fetch bypasses, remote-image CSS var() bypass, pre-auth arbitrary file delete via redis/memcache session poisoning, and LDAP autovalues code-evaluation removal.

Singapore's Cyber Security Agency said in alert AL-2026-131 (3 October 2026) that the vulnerability is reportedly being actively exploited; the alert gives no attack details. (sources: Roundcube security news; GitHub 1.6.16; CSA Singapore)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Roundcube)

Correction (03 Nov 2026): removed SecurityWeek as a source; removed details no other source gives. (source: Roundcube; CSA Singapore)

Product
Roundcube Webmail (virtuser_query plugin)
Versions
1.6.x before 1.6.16; 1.7.x before 1.7.1 (plugin must be enabled for SQLi path)
CVSS
(CVSS 3.1 HIGH, CVE record)
Exploited in Australia?
unknown
Patch to
Upgrade to Roundcube 1.6.16 or 1.7.1 (or later security trains); confirm virtuser_query plugin state; priority for internet-facing webmail; review web/DB/auth logs for pre-auth SQLi probes; backup before upgrade per vendor

vulnerabilities australia cloud identity