CVE-2026-48844

Think of LDAP autovalues as a way your webmail server pulls and updates certain values from a directory service. In the affected versions, the server’s logic can treat some of that input in an unsafe way, like evaluating instructions instead of just reading data. If someone can reach and trigger that path, it may enable them to inject code, potentially impacting accounts, email data, and the stability of your webmail.

This matters if your business runs RoundCube Webmail and you’re on an affected version: 1.6.x before 1.6.16 or 1.7.x before 1.7.1. It’s most relevant when your configuration uses LDAP autovalues/code-evaluation behavior, and the vulnerable feature is reachable through your webmail setup.

There’s no indication here of confirmed exploitation in the wild, so risk is primarily tied to whether you run the affected versions and whether the vulnerable LDAP autovalues path is reachable from your environment (including being reachable from the internet via your webmail).

This is an AMBER issue: the flaw is serious enough to enable code injection, but there’s no record of public exploit code and no KEV listing in the provided findings. However, it’s still worth acting promptly because the vulnerable behavior exists in common webmail software and the fix is available.

Prioritize patching now if your webmail is publicly reachable and you use LDAP autovalues/code-evaluation features.