Cyber Resilience

CVE-2026-48844

High

Published: 25 May 2026

Published
25 May 2026
Modified
26 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 28.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-48844 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Roundcube Webmail (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

CWE(s)
CWE-670

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct RCE via code injection in public-facing web application (Roundcube Webmail).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-35414Shared CWE-670
CVE-2025-43359Shared CWE-670
CVE-2026-33011Shared CWE-670
CVE-2025-58136Shared CWE-670
CVE-2026-38361Shared CWE-670
CVE-2026-34946Shared CWE-670
CVE-2026-26267Shared CWE-670
CVE-2026-40394Shared CWE-670
CVE-2026-40396Shared CWE-670
CVE-2026-40719Shared CWE-670

Affected Assets

Roundcube
Webmail
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References