Roundcube SQL Injection Being Actively Exploited

Roundcube Webmail is the subject of a fresh warning from the Canadian Centre for Cyber Security: a now-patched security hole is being actively exploited in the wild. The flaw, tracked as CVE-2026-48842, has a CVSS score of 8.1 and allows an attacker to run database commands before logging in. It affects Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, so anyone still running those older builds should treat this as an urgent update.

The vulnerability is a pre-authentication SQL injection in the virtuser_query plugin. SQL injection is an attack where a person sends specially crafted input that a website mistakenly passes to its database as commands instead of harmless text. In Roundcube, the problem comes from a backslash escape bypass inside the preg_replace() function, a tool that finds and replaces patterns in text. A backslash is normally used to tell the software that the next character should be treated literally, but the bypass lets an attacker avoid that protection and insert arbitrary SQL statements. Because this happens before a user logs in, the attacker does not need a valid account or password.

The result, as SentinelOne described, is that unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages. That means an attacker could steal login details for email boxes and read or copy private correspondence. Roundcube released patches for the vulnerability in May 2026 as part of versions 1.6.16 and 1.7.1. In an update shared this week, the Cyber Centre said the flaw is being actively exploited in the wild, citing open-source reporting, but no additional details of the exploitation activity have been disclosed.

Exposure numbers from the Shadowserver Foundation underline why the warning matters. As of September 23, 2026, Shadowserver's scans found more than 523,000 Roundcube instances reachable from the internet, with 10 of them flagged as vulnerable hosts. An internet-exposed instance is a Roundcube installation that outsiders can connect to directly, which becomes a larger risk when a known exploit exists. The low number of currently vulnerable hosts may reflect that many operators applied the May patch, but even a handful of unpatched systems can be targeted.

Roundcube has repeatedly attracted attackers because it is a common webmail front end and holds access to email accounts. In July 2026, Proofpoint said it identified a suspected China-aligned adversary tracked as UNK_MassTraction exploiting known security flaws in Roundcube to deliver web shells or a post-exploitation tool called VShell. A web shell is a small malicious program that gives an attacker remote control over a server, while VShell is a tool used after initial access to move around a network. In February 2026, two other Roundcube vulnerabilities, CVE-2025-49113 and CVE-2025-68461, were tagged as actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency, which tracks known exploited vulnerabilities.

For website owners, hosting providers and IT teams, the response is straightforward: confirm which version of Roundcube is running and update to 1.6.16 or 1.7.1 immediately. If you cannot patch right away, disable the virtuser_query plugin temporarily or restrict access to the webmail interface. Because the flaw can expose mail credentials and stored messages, also check for unexpected forwarding rules, new mail filters or login alerts. Organizations that manage their own internet-facing services can work with AEU-I to review patch levels and harden publicly reachable software before attackers take advantage of it.