CVE intelligence

CVE-2026-48842

Vulnerability intelligence

Published May 25, 2026Sources checked Oct 3, 2026

8.1HIGHCVSS out of 10

What this means

Exploitation reported: act now

The Hacker News reports exploitation in the wild. This is separate from CISA KEV membership.

Public exploit: Not collected. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

The Hacker News: Exploitation reported by The Hacker News (2026-09-25)

CISA KEVNot listedBased on the latest collected catalog

EPSS0.9%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-48842?

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.