[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftdWnscJUr0N80CgsloepmD5FP7RTNilPstsIriS1O0g":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"999683e4-d815-47fc-9eaa-4f5231fd721d","Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild","roundcube-pre-auth-sql-injection-flaw-actively-exploited-in-the-wild-8479bf","The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash","The Canadian Centre for Cyber Security has issued a warning regarding the active exploitation of a pre-authentication SQL injection vulnerability (CVE-2026-48842) in Roundcube Webmail. This flaw, affecting versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allows unauthenticated attackers to inject SQL queries, potentially exposing mail account credentials and messages. Patches were released in May 2026, but exploitation is ongoing, with over 523,000 Roundcube instances exposed online.","Roundcube Webmail vulnerability CVE-2026-48842 is actively exploited in the wild.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Froundcube-pre-auth-sql-injection-flaw.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh8MACS_IO_gIvzTjppTIaHyXZKPha3ZR13_sXQS7u9Ajphpz-FRL5GNIQzhpbveUPPLuMCq72MYNtdX5o6gF-9MZZg4rPF7mbOP_pjSXyTVOFy3XtzlQiMH6sIdTdsqgZpgQf-yZmk688M6BiOWdUNYZswJVQETAInFkZVZCl99ZoYoGhhgtpJZ0hs9JmV\u002Fs1600\u002Froundcube.jpg","2026-09-25T10:14:02+00:00","2026-09-25T12:00:10.895741+00:00",8,[17,20,23,26],{"name":18,"type":19},"Roundcube Webmail","product",{"name":21,"type":22},"Roundcube","vendor",{"name":24,"type":25},"UNK_MassTraction","threat_actor",{"name":27,"type":19},"VShell","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-48842","Pre-authentication SQL injection in Roundcube Webmail virtuser_query plugin",[21,18,27],{"controls":48,"vendors":128},[49,78,103],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,95],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":79,"product_name":92,"url":93,"description":94},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":40,"name":104,"problem":105,"products":106},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":124,"product_name":125,"url":126,"description":127},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":142},"roundcube-sql-injection-flaw-exploited-despite-available-patches","Roundcube SQL Injection Flaw Exploited Despite Available Patches","A pre-authentication SQL injection vulnerability in Roundcube Webmail (CVE-2026-48842) is being actively exploited in the wild, allowing unauthenticated attackers to extract mail credentials and message contents without any login required. Patches were made available in May 2026, yet over 523,000 internet-facing instances remain unpatched and exposed — a critical gap between remediation availability and deployment. This situation illustrates the dangerous window that opens when organizations lack timely patch processes for internet-facing applications. The severity is compounded by the pre-authentication nature of the flaw, meaning no user interaction or credential theft is needed to begin an attack. Timely patching of public-facing services is not optional hygiene — it is a frontline defense against mass exploitation campaigns.",[134,135,136,137,138,139,140,141],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL: Change Management \u002F Emergency Change Procedures","OWASP Top 10: A03:2021 – Injection","GDPR Article 32: Security of Processing (obligation to patch known vulnerabilities)",{}]