VulnSocial

CVE-2026-48844Patch

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-670

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-05-28); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-28: 1Mentions · 2026-05-29: 1Mentions · 2026-06-02: 1Patch / Workaround · 2026-05-28: 1Patch / Workaround · 2026-05-29: 1Technical Details · 2026-05-28: 1Technical Details · 2026-05-29: 105-2805-2906-02
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-281
Patch1
2026-05-291
Patch1
2026-06-021
General1
Full discourse3 posts
  • FOFA@fofabot
    Patch

    ⚠️⚠️ CVE-2026-48842 (CVSS 8.1) + CVE-2026-48844 (CVSS 7.5): Pre-auth SQLi in Roundcube virtuser_query plugin; patch to 1.6.16 / 1.7.1. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJSb3VuZGN1YmUtV2VibWFpbCI= 🎯1.1M+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Roundcube-Webmail" 🔖Refer: https://securityonline.info/roundcube-webmail-security-updates/ #OSINT #FOFA #CyberSecurity #Vulnerability

    Post summary

    The post announces CVE-2026-48842 and CVE-2026-48844 in Roundcube’s virtuser_query plugin, provides the required patch versions and a reference to a vendor advisory, but does not discuss PoC, exploitation or false positives.

    13611528215.3K
    14.4K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    Roundcube 1.6.16 öncesi ve 1.7.1 öncesi sürümleri etkileyen yüksek CVSS skorlu Güvenlik Açıkları duyuruldu. SQL Injection ve RCE riski var. Roundcube sürümünüzü 1.7.1 veya 1.6.16 sürümlerinden birine güncelleyin. CVE: CVE-2026-48842 CVE-2026-48843 CVE-2026-48848 CVE-2026-48844

    Post summary

    High‑CVSS vulnerabilities affecting Roundcube versions prior to 1.6.16/1.7.1 were disclosed, exposing SQL Injection and RCE risks; users are advised to update to 1.7.1 or 1.6.16 to mitigate the issue.

    00020382
    1.2K followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos Roundcube ❗ CVE-2026-48848 ❗ CVE-2026-48844 ❗ CVE-2026-48842 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-roundcube-2/ https://t.co/SiNDcHSZ7h

    Post summary

    The tweet announces three Roundcube CVEs and directs readers to an external link for additional information, with no further technical or exploit details provided.

    00000172
    6.7K followersView on X

Explore more

Back to dashboard