{"vulnerability": "CVE-2026-48842", "sightings": [{"uuid": "80365802-3cb4-40d7-b16b-db6fc21c33b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-roundcube-webmail-3", "content": "", "creation_timestamp": "2026-05-26T06:30:12.000000Z"}, {"uuid": "8edfb1a0-ecbf-4af7-8f0c-8ae83e613f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913", "content": "This September 21, 2026 threat intelligence digest highlights four critical vulnerabilities requiring immediate patching: **Joplin Server** (CVE-2026-46649) and **Warpgate** (CVE-2026-58491) contain unmitigated SSO flaws enabling credential brute-forcing and reflected XSS/open redirects, respectively; **Roundcube Webmail** (CVE-2026-48842) is actively exploited in the wild; and **Zyxel GS1900 switches** (CVE-2026-7273) feature a stack-based buffer overflow now listed in CISA\u2019s KEV database. Additionally, community reports suggest a potential compromise of the OWASP API Security page, while a weekly cyber warfare brief tracks state-aligned operations and references CVE-2026-76460/76461. Administrators are urged to prioritize updates to Joplin \u22653.7.2, Warpgate \u22650.25.5, Roundcube \u22651.6.16/1.7.1, and affected Zyxel firmware, while verifying third-party resource integrity.", "creation_timestamp": "2026-09-22T00:03:05.046528Z"}, {"uuid": "99e0ea05-18df-4030-9d74-85bf05bf2024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "content": "", "creation_timestamp": "2026-09-22T00:15:04.778684Z"}, {"uuid": "ece6d2ca-7b06-4067-9d94-ebb29c1a99c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwabwlniam2l", "content": "An exploited Roundcube Webmail vulnerability allows SQL injection attacks. Learn how CVE-2026-48842 impacts servers and apply the latest patches immediately.\n\n#Roundcube #Cybersecurity #CVE202648842 #Vulnerability #SQLInjection", "creation_timestamp": "2026-09-24T03:12:43.476052Z"}, {"uuid": "5bd02fef-a4bb-4abe-a881-dfa428c7f19e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwatslyogi2u", "content": "Roundcube SQL injection flaw (CVE-2026-48842) is being actively exploited\u2014patch to 1.6.16 or 1.7.1 now. #SecurityNews #Cybersecurity #Roundcube #SQLInjection #EmailSecurity https://thedailytechfeed.com/urgent-fix-issued-as-roundcube-sql-injection-vulnerability-now-actively-exploited/", "creation_timestamp": "2026-09-24T08:32:37.287738Z"}, {"uuid": "ce0de5c7-04b7-4f15-a131-b9a8b364ba20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwbfcaxln42k", "content": "\ud83e\udd16 CVE-2026-48842: pre-auth SQLi in Roundcube Webmail (virtuser_query), patched in May, now actively exploited. Attackers can bypass auth and steal DB data.\nhttps://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/", "creation_timestamp": "2026-09-24T13:45:36.089724Z"}, {"uuid": "7845b322-28ff-49db-bbcb-7892b3d5a408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mwbglwlrzg2d", "content": "Roundcube CVE-2026-48842: Passwordless Attack on Webmail", "creation_timestamp": "2026-09-24T14:08:54.462368Z"}, {"uuid": "db52c5de-16b7-475d-9f48-d46fc9ef8402", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwblsmbtfs2p", "content": "Whoa. Canada just flagged Roundcube CVE-2026-48842 as wild. Pre-auth SQL in virtuser_query, patched in May, half a million boxes still waving. You left webmail on the porch for four months, Morty. day267.025", "creation_timestamp": "2026-09-24T15:42:09.645429Z"}, {"uuid": "bf2f83b5-aa3e-4341-9847-f61b315944fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwboivjsjq2m", "content": "Critical Roundcube flaw CVE-2026-48842 is being actively exploited in the wild, enabling pre-auth SQL injection via virtuser_query and possible auth bypass. #Roundcube #Canada #CVE-2026-48842", "creation_timestamp": "2026-09-24T16:30:23.073650Z"}, {"uuid": "d76e1678-9b13-4550-8f2f-cf8e1a61414e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwcnqw4lvd24", "content": "Exploited Roundcube Webmail Vulnerability CVE-2026-48842\uff08Roundcube Webmail\u306e\u8a8d\u8a3c\u524dSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3001\u5b9f\u653b\u6483\u3067\u306e\u60aa\u7528\u3092\u78ba\u8a8d\uff09 #SecurityOnline \uff08Sep 24\uff09\n\nsecurityonline.info/exploited-ro...", "creation_timestamp": "2026-09-25T01:49:37.871806Z"}, {"uuid": "076d245c-b082-446e-9649-214e4a4d2538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwd3sqqyob2n", "content": "\ud83e\udd16 CVE-2026-48842: pre-auth SQL injection in Roundcube Webmail is now actively exploited. No privileges or interaction needed; bypasses auth, dumps DB. Fix: 1.6.16/1.7.1.\nhttps://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/", "creation_timestamp": "2026-09-25T06:01:12.108486Z"}, {"uuid": "879e350e-1ead-4fc3-a8f8-07b51375a5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mwd5xt3tv62s", "content": "Roundcube Webmail Vulnerability CVE-2026-48842 Actively\u00a0Exploited\n\nA high-severity security vulnerability in Roundcube Webmail that was patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.", "creation_timestamp": "2026-09-25T06:39:49.775858Z"}, {"uuid": "ba9d4a87-c23d-4e6c-b616-62df53705529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwd7ejuryz2i", "content": "CVE-2026-48842 enables unauthenticated SQL injection in Roundcube\u2019s virtuser_query plugin, bypassing escaping and allowing database tampering and data access.\n", "creation_timestamp": "2026-09-25T07:04:49.859172Z"}, {"uuid": "9558c31f-b2f7-46e3-8137-8d94bde39d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwdcp4ka5ky4", "content": "Roundcube\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u308b\u3088\u3046\u306b\uff1aCVE-2026-48842 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47835/", "creation_timestamp": "2026-09-25T08:04:59.680346Z"}, {"uuid": "07ec6102-d42c-42a6-8efa-95b8e38b6e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "96c16751-1b73-43f8-8ab4-831c0a20223d", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "content": "", "creation_timestamp": "2026-09-25T08:56:57.646578Z"}, {"uuid": "f787bfe3-ceda-40a4-9331-c6405019bf60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwdfte3rbv2c", "content": "Roundcube Webmail is affected by CVE-2026-48842, a high-severity unauthenticated SQL injection in virtuser_query. Exploitation can expose messages, address books, and user identities. #Roundcube #SQLInjection #CVE202648842", "creation_timestamp": "2026-09-25T09:00:30.271169Z"}, {"uuid": "cbf80ee3-dedc-4ae8-b880-dd2ecd15c4f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwdiz4jaou24", "content": "Learn how hackers are exploiting the CVE-2026-48842 Roundcube SQL injection vulnerability. Understand the risk and how to patch your webmail server immediately.\n\n#Roundcube #CyberSecurity #SQLInjection #DataBreach #TechNews", "creation_timestamp": "2026-09-25T09:57:24.712523Z"}, {"uuid": "fa8f7e48-9224-4841-af81-75dcfe8ac371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/information_security_channel/55976", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs (https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-25T07:09:06.000000Z"}, {"uuid": "7133ef3a-2fc1-42c6-be67-1262e15153ac", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d60be5ee-8dc0-4445-8ee3-de257a629592", "content": "", "creation_timestamp": "2026-09-25T10:00:29.307107Z"}, {"uuid": "4af9d264-2ba8-4d44-9b2d-0918365e77ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "content": "Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\n\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.", "creation_timestamp": "2026-09-25T04:57:40.000000Z"}, {"uuid": "939e00b9-6a2e-4568-a523-f8d69d946548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwdktwt4dw2q", "content": "Roundcube Webmail SQL injection (CVE-2026-48842) actively exploited. CCCS confirmed. Fixed versions: 1.6.16\u2026 https://0daynews.com/articles/2026-09-24-roundcube-cve-2026-48842-active-exploit-sql-injection/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3504", "creation_timestamp": "2026-09-25T10:30:17.881647Z"}, {"uuid": "f88d7e72-3d6d-42d9-9bdd-0559874107d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/thehackernews/10163", "content": "\ud83d\udea8 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.\n\nRead: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "creation_timestamp": "2026-09-25T10:22:31.000000Z"}, {"uuid": "a6553658-8df0-413c-9e4f-e86f5aece0bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/l-AGua03RTgi38TNixvdVgH0A7JTaud21SGo-fbQkZKHWK4", "content": "", "creation_timestamp": "2026-09-25T07:00:32.000000Z"}, {"uuid": "6e7af802-a260-4840-a6db-97e4a0f82ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/information_security_channel/55976", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs (https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-25T07:09:06.000000Z"}, {"uuid": "cd49cd7e-52c8-4582-adff-dcd603b6d177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwdmlndrcz2z", "content": "Roundcube \u306e\u8a8d\u8a3c\u524dSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u60aa\u7528\u4e2d\n\nRoundcube \u306e CVE-2026-48842 (SQL\u6ce8\u5165)\u304c\u91ce\u751f\u3067\u6d3b\u767a\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u30021.6.x(1.6.16\u672a\u6e80)\u30681.7.x(1.7.1\u672a\u6e80)\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u3002\u7dca\u6025\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u5fc5\u8981\u3067\u3059\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-25T11:01:27.472091Z"}, {"uuid": "de43a4d7-44a5-4a8b-b2dc-417b1a980321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwdpcby7mj2k", "content": "Roundcube Webmail\u306eSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\uff08CVE-2026-48842\uff09\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u653b\u6483\u8005\u304c\u60aa\u7528\u53ef\u80fd\u3002", "creation_timestamp": "2026-09-25T11:49:53.978496Z"}, {"uuid": "741d0e96-92e6-4d28-92f0-735ca73bc4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/thehackernews/10163", "content": "\ud83d\udea8 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.\n\nRead: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "creation_timestamp": "2026-09-25T10:22:31.000000Z"}, {"uuid": "fb1fcd2b-8cb8-410e-9044-f359f4ce2999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/GithubRedTeam/103304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "563c0f1c-ab9b-450a-bbe8-997278423fcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/GithubRedTeam/103305", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pocbit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "8a72e8f6-41d4-4d41-b9ef-dc3e9503fe33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/l-AGua03RTgi38TNixvdVgH0A7JTaud21SGo-fbQkZKHWK4", "content": "", "creation_timestamp": "2026-09-25T07:00:32.000000Z"}, {"uuid": "dcf33cdc-1ef2-4865-9282-dcfd12ad6ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/a75d075b634c5b72a80aeacabcd23bc1", "content": "This daily threat intelligence briefing highlights four key developments:\n\n\u2022 **Critical & Actively Exploited Vulnerabilities:** Immediate patching is required for a critical WordPress path traversal (CVE-2026-87902), a pre-auth SQL injection in Roundcube (CVE-2026-48842), and a WordPress plugin privilege escalation/OTP bypass (CVE-2026-14281, CVSS 9.8). An Akia keyless entry IDOR (CVE-2026-97898) was remediated on Sept 19.\n\n\u2022 **Major Crypto Exchange Breach:** Suspected North Korean actors stole $351.6M from Bitget by compromising hot and warm wallets; cold storage and the majority of platform funds remain secure.\n\n\u2022 **AI Misuse & Surveillance Accountability:** Anthropic\u2019s report details how AI is industrializing cybercrime, influence operations, and state-level surveillance through human-AI task division. Separately, experts urge Flock Safety to implement stricter access controls, graduated data retention, independent oversight, and legislative safeguards to prevent misuse of its automated license-plate network.\n\n\u2022 **Platform Moderation:** One Reddit post was removed for violating content policies.", "creation_timestamp": "2026-09-25T12:00:39.000000Z"}, {"uuid": "08838f7f-effc-4ee2-84e5-b9e01f080131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "content": "The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.\n\nThe vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.\n\nThe issue stems from a preg_replace() backslash", "creation_timestamp": "2026-09-25T08:14:02.000000Z"}, {"uuid": "2f79b858-fb73-42e2-85ba-d3b830241337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwdwznmlih2r", "content": "\ud83e\udd16 CVE-2026-48842 (CVSS 8.1): pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin, actively exploited in the wild per Canadian Centre for Cyber Security. Affects 1.6.x < 1.6.16 and 1.7.x < 1.7.1 \u2014 patch\u2026", "creation_timestamp": "2026-09-25T14:08:13.989310Z"}, {"uuid": "2026eabc-86f1-480c-b5d1-4b4303756e8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/SHe9Cp0DW5CABQfiZlrEd0j4AB_Erb3QMjxj3ZAcjBCREw", "content": "", "creation_timestamp": "2026-09-25T10:42:03.000000Z"}, {"uuid": "6fa49c7d-e2e2-4415-ab91-04e056377e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}, {"uuid": "bf7e060c-53c7-4b29-86a0-847fd24f3695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "2274f4c9-a6de-4218-97df-aceff9e3cab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103305", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pocbit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "fb85e26b-9a17-43e9-9de8-efc3a579a9a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/b3032a708e4fafadc23b436584116971", "content": "This daily threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging operational challenges from September 2026. Key developments include:\n\n\u2022 **Malware & Active Exploits:** PamStealer macOS has evolved with server-side decryption and multi-layer persistence. Roundcube Webmail is under active SQL injection attacks (CVE-2026-48842), and new research details an Avast sandbox bypass.\n\u2022 **Critical Patches & Advisories:** Urgent updates are required for MikroTik RouterOS (multiple actively exploited CVEs), Linux Kernel RDMA components, ServiceNow AI Platform, and GitLab (critical patch advisory AV26-962). GitLab also faces a separate design flaw where project-scoped email tokens bypass IP restrictions, enable account-wide reuse, and risk CI/CD compromise. Additionally, Rojo\u2019s HTTP API contains a high-severity DNS rebinding vulnerability.\n\u2022 **Operational Shifts:** AI is lowering the cost of failed attack retries, enabling rapid privilege escalation attempts rather than introducing novel vectors. Meanwhile, Microsoft\u2019s release of 972 patches underscores growing patch management strain, particularly for solo administrators.\n\n**Takeaway:** Immediate patching, strict credential/token management, and SOC strategy adjustments to counter AI-driven attack persistence are prioritized across all advisories.", "creation_timestamp": "2026-09-25T16:00:46.000000Z"}, {"uuid": "0d382233-c66a-47e9-9230-b4bdd82ef4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "Telegram/SHe9Cp0DW5CABQfiZlrEd0j4AB_Erb3QMjxj3ZAcjBCREw", "content": "", "creation_timestamp": "2026-09-25T10:42:03.000000Z"}, {"uuid": "5523c06b-7f3e-4698-8d36-7f92af93e50a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}, {"uuid": "8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mweavhvlf42h", "content": "Unauthenticated SQLi (CVE-2026-48842) in Roundcube's virtuser_query plugin lets attackers steal mail data. Patches were out in May '26. That it's still actively exploited makes me intrigued and worried about patching ...", "creation_timestamp": "2026-09-25T17:04:57.566916Z"}, {"uuid": "543376b7-000d-4acf-8588-858a6d5fc53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117333123897233909", "content": "\ud83d\udea8 Roundcube SQL injection flaw actively exploited months after patches were released\nThe Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild.\u2800Roundcube is an open-source webmail application that lets people access email through a browser.\nThe flaw affects its virtuser_query plugin and allows SQL injection before authentication.\u2800Key details:\n\u2022 CVSS score: 8.1\u2022 No attacker credentials required\u2022 No user interaction required\u2022 Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1\u2800Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting.\nThe advisory does not identify the attackers, victims or scale of exploitation.\u2800Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities.\nSource: https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "creation_timestamp": "2026-09-25T18:36:28.270327Z"}, {"uuid": "257e15b6-08c5-4362-a398-af18e919b384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/VulnerabilityNews/44615", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "creation_timestamp": "2026-09-25T23:00:56.000000Z"}]}