CVE-2026-48844

Think of LDAP autovalues as a way your webmail server pulls and updates certain values from a directory service. In the affected versions, the server’s logic can treat some of that input in an unsafe way, like evaluating instructions instead of just reading data. If someone can reach and trigger that path, it may enable them to inject code, potentially impacting accounts, email data, and the stability of your webmail.

This matters if your business runs RoundCube Webmail and you’re on an affected version: 1.6.x before 1.6.16 or 1.7.x before 1.7.1. It’s most relevant when your configuration uses LDAP autovalues/code-evaluation behavior, and the vulnerable feature is reachable through your webmail setup.

There’s no indication here of confirmed exploitation in the wild, so risk is primarily tied to whether you run the affected versions and whether the vulnerable LDAP autovalues path is reachable from your environment (including being reachable from the internet via your webmail).

This is an AMBER issue: the flaw is serious enough to enable code injection, but there’s no record of public exploit code and no KEV listing in the provided findings. However, it’s still worth acting promptly because the vulnerable behavior exists in common webmail software and the fix is available.

Prioritize patching now if your webmail is publicly reachable and you use LDAP autovalues/code-evaluation features.

1. Inventory and confirm exposure

   • Identify your exact RoundCube Webmail version.
   • Review your RoundCube configuration for LDAP-related usage, specifically any “autovalues” configuration or any behavior that depends on LDAP autovalues code-evaluation.

2. Decide if you need the patch

   • If you are on RoundCube Webmail 1.6.x < 1.6.16 or 1.7.x < 1.7.1, assume you should patch.
   • If LDAP autovalues/code-evaluation is not in use, the risk may be lower, but patching is still the correct remediation because the vulnerable logic exists in those versions.

3. Upgrade to the fixed versions (primary remediation)

   • Upgrade RoundCube Webmail 1.6.x to 1.6.16 or later.
   • Upgrade RoundCube Webmail 1.7.x to 1.7.1 or later.
   • Note: the vendor states that support for code evaluation was removed in 1.6.16 and 1.7.1.

4. Temporary mitigation while patching (if upgrade is delayed)

   • Disable or remove LDAP autovalues/code-evaluation usage according to the vendor’s remediation guidance.
   • Validate that your webmail still functions for your normal email/LDAP use cases.

5. After the change

   • Monitor webmail application logs for unusual LDAP-related errors, suspicious requests, or configuration changes.
   • Re-confirm the deployed version matches the target fixed version (1.6.16 or 1.7.1+) across environments (production, staging, backups if applicable).

6. Timing

   • Since no KEV/news exploitation confirmation is provided here, focus on getting patched soon rather than emergency shutdown; use your normal change window, but do not postpone indefinitely given code-injection impact and public-facing webmail.

CVE-2026-48844 is a code-injection risk (CWE-670) in RoundCube Webmail. The mechanism is insecure code evaluation logic associated with the LDAP “autovalues” option; attacker-controlled directory/LDAP data (when processed through the vulnerable logic) could be interpreted in an executable way rather than as data. The vendor remediation removes support for code evaluation in the fixed releases (1.6.16 and 1.7.1).

Status/exploitation signals from findings: not listed in CISA KEV; no public exploit code on record; EPSS is low (predicted likelihood 0.4% with flat trend), and there is rising press attention, but neither press nor prediction equals confirmed exploitation.

Traffic-light verdict for this CVE is AMBER: meaningful impact potential (code injection, confidentiality and integrity risk) with no confirmed exploitation evidence in the provided findings, but patch availability makes it practical to remediate.