Active Roundcube Attacks Put Pre-Login SQL Injection at the Top of Patch Queues

Canadian warning confirms real-world exploitation

The Canadian Centre for Cyber Security has warned that attackers are exploiting CVE-2026-48842, a pre-authentication SQL injection vulnerability in Roundcube Webmail.

The alert cites open-source reporting but does not disclose who is conducting the attacks, which organizations have been targeted, or what infrastructure and payloads are involved. No exploit requests, malicious indicators, or forensic artifacts have been published.

That limited visibility does not reduce the operational urgency. An attacker can reach the vulnerable code without first authenticating, and successful exploitation may expose mail-account credentials and messages stored through the affected database backend.

Roundcube patched the vulnerability in May 2026. Installations still running earlier affected releases therefore face a known, remotely reachable flaw for which fixed versions are already available.

As of September 25, 2026, no CISA Known Exploited Vulnerabilities catalog entry or federal remediation deadline has been identified for CVE-2026-48842. The Canadian warning nevertheless establishes that exploitation is not merely theoretical.

The vulnerable plugin and exact affected releases

CVE-2026-48842 is located in Roundcube’s virtuser_query plugin, which performs database queries associated with virtual-user handling.

The affected release branches are:

• Roundcube Webmail 1.6.x before 1.6.16
• Roundcube Webmail 1.7.x before 1.7.1

Roundcube 1.6.16 and 1.7.1 contain the fixes. Administrators running the affected branches should upgrade to one of those releases rather than relying solely on perimeter filtering.

The underlying weakness involves an evasion of backslash-escape processing performed through preg_replace(). By bypassing the intended escaping behavior, an unauthenticated attacker can introduce SQL syntax into a query sent to the backend database.

The vulnerability is classified as CWE-89, the category for improper neutralization of special elements in SQL commands. The National Vulnerability Database assigns it a CVSS v3 score of 8.1, with the vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

That vector describes a network-accessible issue requiring no privileges and no user interaction. It is rated as high complexity, but a successful attack can have high confidentiality, integrity, and availability consequences. The scope remains unchanged under the CVSS assessment.

Technical details sufficient to reproduce the exploitation chain have not been disclosed in the warning. It is also unknown whether current attackers are using a private exploit, adapting publicly available research, or relying on automated scanning.

Internet exposure creates a broad target pool

Shadowserver Foundation measurements cited in reporting found more than 523,000 internet-exposed Roundcube instances. Of those, 10 were flagged as vulnerable hosts as of September 23, 2026.

Those figures should not be interpreted as a complete count of exploitable systems. Exposure measurements can include patched servers, deployments with different plugin configurations, reverse proxies, and instances whose exact versions cannot be determined remotely. Conversely, vulnerable systems may not always be identifiable by an external scan.

The 10 flagged hosts represent systems that the measurement process could identify as vulnerable, not necessarily the full affected population.

Roundcube is commonly exposed as a public webmail interface, making pre-authentication vulnerabilities particularly consequential. Attackers do not need an existing mailbox account to reach the vulnerable path described for CVE-2026-48842.

Reported outcomes include possible access to mail-account credentials and stored messages. The precise result will depend on the database contents, configuration, privileges assigned to the Roundcube database user, and the attacker’s ability to build a working injection.

No confirmed victim list has been released. There is also no disclosed evidence connecting the activity to ransomware deployment.

Current attacks remain largely opaque

Defenders do not yet have a published set of campaign-specific indicators for CVE-2026-48842. The Canadian warning provides no malicious IP addresses, domains, request strings, filenames, web-shell paths, or payload hashes.

Attribution is similarly unresolved.

Proofpoint reported in July 2026 that a suspected China-aligned actor tracked as UNK_MassTraction had exploited known Roundcube vulnerabilities to install web shells or VShell, a post-exploitation tool. That activity should not be automatically attributed to CVE-2026-48842: the identified vulnerabilities were not described as this SQL injection flaw.

Without disclosed request patterns, defenders cannot rely on a campaign-specific web application firewall signature. They should instead examine web-server and application logs for unusual unauthenticated traffic directed at Roundcube, particularly requests associated with the virtuser_query plugin.

Database logs may also reveal malformed queries, repeated syntax errors, or unexpected query structures. Those observations are investigative leads, not definitive indicators of CVE-2026-48842 exploitation.

Administrators should also check for unexplained changes to web-accessible files, unexpected processes, newly created accounts, and anomalous database access. No specific web-shell name or filesystem location has been tied to this campaign, so hunting should remain behavior-based.

Upgrading is the primary remediation

Operators should first determine the installed Roundcube branch and whether virtuser_query is present or enabled. All affected installations should then be upgraded as follows:

• Upgrade 1.6.x systems to Roundcube 1.6.16 or later.
• Upgrade 1.7.x systems to Roundcube 1.7.1 or later.

The available information does not describe a vendor-approved workaround that provides protection equivalent to the patched releases. Disabling unnecessary components may reduce exposure, but it should not replace upgrading where the vulnerable plugin is used.

After patching, organizations should not assume that the update removes an earlier compromise. Systems exposed before remediation warrant a review of web, application, authentication, and database logs covering the period during which the vulnerable version was reachable.

Credential rotation should be considered where investigation finds suspicious database access or evidence that account secrets may have been retrieved. The need and scope of that action will depend on what the particular Roundcube database stored and what access the application account possessed.

External attack-surface inventories should also be checked for forgotten webmail hosts. An internally maintained software inventory may miss temporary, legacy, or departmental deployments reachable from the internet.

Roundcube has faced repeated exploited flaws

CVE-2026-48842 follows other Roundcube vulnerabilities that CISA has treated as actively exploited.

CVE-2025-49113 is a PHP object-deserialization issue caused by insufficient validation of the _from URL parameter in program/actions/settings/upload.php. An authenticated remote attacker can use it to achieve code execution.

It affects Roundcube Webmail before 1.5.10, Roundcube 1.6.x before 1.6.11, and Debian Linux 11.0. NVD rates it 9.9 under CVSS v3, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and classifies it as CWE-502.

CVE-2025-68461 is an SVG animate tag cross-site scripting vulnerability affecting Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12. It carries a CVSS v3 score of 7.2 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

CISA added both vulnerabilities to its KEV catalog on February 20, 2026, setting March 13, 2026 as the remediation deadline for US federal agencies. The required action was to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue the product if mitigations were unavailable.

Another vulnerability associated with Debian and Roundcube, CVE-2025-39682, entered the KEV catalog on September 18, 2026. No additional technical details about that issue are established here.

For Roundcube operators, the pattern makes version management and exposure monitoring more than routine maintenance. The immediate task is clear: identify every reachable deployment and move CVE-2026-48842-affected systems to 1.6.16 or 1.7.1 without delay.