Roundcube patched a high-severity vulnerability four months ago. Attackers are now targeting systems that still have not installed the fix.
The flaw, tracked as CVE-2026-48842, is a pre-authentication SQL injection vulnerability affecting older Roundcube versions.
Canada’s cyber security agency warned on Sept. 21 that open-source reporting shows the flaw is being exploited in the wild, turning a previously patched issue into an active risk for organizations still running vulnerable servers.
Roundcube patched the vulnerability in two releases on May 24. The newly reported exploitation is therefore less about a newly discovered flaw than what…
Read the full article at TECHREPUBLIC.COM
