bleeping-computer · Crawled Sep 24, 2026
Hackers now exploit critical Roundcube flaw in code injection attacks
2 Actors 7 CVEs
Read original article ↗
AI Summary
A critical pre-authenticated SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is now being actively exploited in the wild. The flaw exists in the virtuser_query plugin and allows unauthenticated attackers to bypass authentication, execute malicious database commands, and steal data without user interaction. The Canadian Centre for Cyber Security has issued an updated advisory warning of ongoing exploitation, urging administrators to update to patched versions 1.6.16 or 1.7.1, or disable the vulnerable plugin if immediate patching is not possible. Roundcube instances have been frequent targets in the past, including by state-backed groups such as APT28 and TA473.
AI-extracted · verify before operational use
Extracted Entities 9 found
MITRE ATT&CK TTPs 23 techniques
T1059.001 PowerShell · Execution T1003 OS Credential Dumping · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078.004 Cloud Accounts · Defense Evasion T1090 Proxy · Command And Control T1114 Email Collection · Collection T1136.001 Local Account · Persistence T1204.002 Malicious File · Execution T1556.005 Reversible Encryption · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1558.003 Kerberoasting · Credential Access T1566 Phishing · Initial Access T1085 T1085 T1087.002 Domain Account · Discovery T1134 Access Token Manipulation · Defense Evasion T1203 Exploitation for Client Execution · Execution T1218 System Binary Proxy Execution · Defense Evasion T1480 Execution Guardrails · Defense Evasion