Attackers Target Unpatched Roundcube Servers With CVE-2026-48842
ID: 16ea6d55-818d-5642-9453-dae52284067a
STIX ID: report--16ea6d55-818d-5642-9453-dae52284067a
Feed Name: TechRepublic Security
Threat Score
A high-severity pre-authentication SQL injection vulnerability (CVE-2026-48842) in Roundcube's virtuser_query plugin was patched on May 24 but is now being actively exploited against unpatched installations; public reporting (including the Canadian Center for Cyber Security and Shadowserver) highlights the scale of potentially exposed instances and urges administrators to apply updates immediately to avoid compromise.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.