[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fr4XFtrkAyL1fcwyj76G6rtEbj3vpJ4P2IVTt_v4pnIM":3},{"article":4,"iocs":50,"watch_terms":62,"solutions":63,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"743c0ec6-c4a1-434f-afa2-af54953fb7b3","Roundcube Webmail Vulnerability in Attackers’ Crosshairs","roundcube-webmail-vulnerability-in-attackers-crosshairs-d1f0d3","Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication. The post Roundcube Webmail Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.","Threat actors are actively exploiting a critical SQL injection vulnerability (CVE-2026-48842) in the Roundcube webmail client's virtuser_query plugin. This unauthenticated vulnerability allows attackers to tamper with database operations, access sensitive user data, and map authentication workflows. Roundcube has released patches in versions 1.6.16 and 1.7.1.","Roundcube Webmail vulnerability CVE-2026-48842 is being exploited in the wild.","https:\u002F\u002Fwww.securityweek.com\u002Froundcube-webmail-vulnerability-in-attackers-crosshairs\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F08\u002FEmail-Security.jpg","2026-09-25T06:57:40+00:00","2026-09-25T08:00:02.892742+00:00",8,[17,20,23,25],{"name":18,"type":19},"Roundcube","product",{"name":21,"type":22},"webmail client","technology",{"name":24,"type":22},"SQL injection",{"name":26,"type":19},"virtuser_query","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,60],{"type":52,"value":53,"context":54},"cve","CVE-2026-48842","SQL injection vulnerability in Roundcube virtuser_query plugin",{"type":52,"value":56,"context":57},"CVE-2025-68961","Previous Roundcube vulnerability",{"type":52,"value":59,"context":57},"CVE-2025-49113",{"type":52,"value":61,"context":57},"CVE-2024-37383",[18,26],{"controls":64,"vendors":148},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":49,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":144,"product_name":145,"url":146,"description":147},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":162},"critical-sql-injection-in-roundcube-webmail-actively-exploited","Critical SQL Injection in Roundcube Webmail Actively Exploited","A critical unauthenticated SQL injection vulnerability (CVE-2026-48842) in Roundcube Webmail's virtuser_query plugin is being actively exploited in the wild, allowing attackers to manipulate database operations and access sensitive user data without any credentials. The unauthenticated nature of this flaw makes it especially dangerous, as it dramatically lowers the barrier for exploitation — no account takeover or phishing step is required. Organizations running unpatched Roundcube instances are directly exposing email authentication workflows and potentially all stored user data to threat actors. This incident underscores the critical importance of timely patch application for internet-facing services, where the window between vulnerability disclosure and active exploitation is increasingly narrow.",[154,155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","OWASP A03:2021 – Injection","GDPR Article 32: Security of Processing (for EU organizations handling user data)",{}]