Roundcube Servers Face Active Attacks Through Pre-Login Database Injection

Exploitation warning follows an earlier security update

Attackers are reportedly exploiting CVE-2026-48842, a Roundcube Webmail SQL injection vulnerability that can be reached before authentication.

The Canadian Centre for Cyber Security said open-source reporting indicates active exploitation and urged administrators to secure affected webmail servers. The warning was reported on September 24, 2026, roughly four months after Roundcube patched the flaw.

Roundcube addressed the vulnerability in versions 1.6.16 and 1.7.1. Its security announcement is dated May 24, 2026, while the NVD entry was published on May 25 and last modified on July 24.

No attacker, campaign, victim organization, or targeted region has been identified. There are also no published indicators of compromise specifically tied to exploitation of this vulnerability.

The active-exploitation assessment comes from the CCCS statement relayed in public reporting. CVE-2026-48842 is not shown among the Roundcube entries in CISA’s Known Exploited Vulnerabilities catalog, so it should not be described as a CISA-confirmed KEV vulnerability.

A backslash-escape bypass enables SQL injection

CVE-2026-48842 affects Roundcube’s built-in virtuser_query plugin, which performs database-backed user lookups and maps users to email addresses.

The vulnerability results from a backslash-escape bypass involving PHP’s preg_replace() function. Improper handling of attacker-controlled input can allow SQL syntax to pass through the plugin’s intended filtering and reach the underlying database query.

The issue is classified as CWE-89, improper neutralization of special elements in an SQL command. Because the vulnerable path is accessible before login, an attacker does not need an existing Roundcube account or other prior privileges.

Successful exploitation may allow malicious SQL commands to be executed against the Roundcube database. The reported consequences include unauthorized access to stored data, while the CVSS assessment assigns high potential impact to confidentiality, integrity, and availability.

Exploitation is nevertheless characterized as technically difficult. The CVSS 3.1 rating is 8.1, with the vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

That vector describes a network-accessible attack requiring high complexity, but no privileges and no user interaction. The scope remains unchanged.

NVD has not supplied its own base-score assessment. The vector displayed in its record was contributed by MITRE as the CVE Numbering Authority. Although some reporting labels the flaw critical and other coverage calls it high-severity, NVD does not provide an independent score that resolves that terminology.

Two supported release branches are affected

The vulnerable version ranges are:

• Roundcube Webmail 1.6.0 through 1.6.15
• Roundcube Webmail 1.7.0
• More formally, NVD lists 1.6.0 to before 1.6.16 and 1.7.0 to before 1.7.1

Administrators should upgrade the applicable branch to 1.6.16 or 1.7.1. Roundcube’s remediation references include the release pages and GitHub commits 3406183a9976e36f992d3468f37d0e2346526ee9 and 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b.

These commit hashes identify remediation work. They are not malicious indicators.

Roundcube is an open-source, browser-based IMAP client used as the default webmail interface by many hosting and email services. It is also distributed with the widely deployed cPanel hosting control panel, increasing the likelihood that installations are managed by hosting providers rather than individual mailbox users.

Shadowserver was reportedly tracking more than 523,000 Internet-exposed Roundcube instances. That figure should not be treated as a vulnerable-host count: it may include patched servers, unaffected configurations, and honeypots.

The affected component is specifically virtuser_query. Administrators therefore need to verify both the installed Roundcube version and whether this plugin is present and enabled.

Immediate actions for Roundcube administrators

Upgrading is the primary corrective action. Operators should move installations to 1.6.16 or 1.7.1, depending on the deployed branch, and prioritize systems directly reachable from the Internet.

If an immediate update cannot be completed, the reported interim mitigation is to disable or remove virtuser_query. Doing so removes the vulnerable plugin path, although administrators should assess whether any local identity-mapping workflow depends on it.

A practical response sequence is:

1. Inventory Internet-facing Roundcube deployments, including installations bundled with hosting-control software.
2. Record the exact Roundcube branch and patch level.
3. Determine whether virtuser_query is installed and active.
4. Upgrade to 1.6.16 or 1.7.1.
5. Disable or remove the plugin where patching must be delayed.
6. Review database and web-server telemetry for unexplained requests, query errors, or unauthorized database activity.

No exploitation-specific request pattern, payload, log signature, IP address, domain, or file artifact has been disclosed. Defenders should therefore avoid presenting generic SQL injection strings as confirmed indicators for this campaign.

The absence of public indicators also limits retrospective investigation. Version and configuration checks can establish exposure, but they cannot by themselves prove that a server was or was not compromised.

CISA has not added this CVE to KEV

The distinction between a public exploitation report and a KEV listing matters operationally. CISA’s catalog can impose remediation deadlines on U.S. federal civilian agencies under applicable directives; the CCCS warning does not create such a CISA deadline.

As of September 24, 2026, the supplied CISA Roundcube catalog results do not include CVE-2026-48842. There is consequently no CISA KEV addition date or federal remediation due date for this flaw.

CISA has, however, repeatedly added other Roundcube vulnerabilities to KEV. Its catalog shows 11 Roundcube results, placing the current incident within a sustained pattern of real-world attacks against the webmail platform.

Two recent examples were added on February 20, 2026:

• CVE-2025-49113, an authenticated PHP object-deserialization flaw with a 9.9 CVSS score.
• CVE-2025-68461, an SVG animate cross-site scripting vulnerability with a 7.2 score.

For both vulnerabilities, federal agencies had a March 13, 2026 remediation deadline. CISA required vendor mitigations, applicable BOD 22-01 measures for cloud services, or discontinuation where mitigations were unavailable.

Roundcube remains a recurring espionage target

Previous Roundcube flaws have been associated with government-focused cyber-espionage operations. Winter Vivern, also tracked as TA473, reportedly exploited the stored XSS vulnerability CVE-2023-5631 against European government entities.

APT28 reportedly used CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026 in operations targeting Ukrainian government email systems. All four vulnerabilities are in CISA’s KEV catalog.

That history does not identify the actor exploiting CVE-2026-48842. It does, however, show why exposed webmail infrastructure attracts capable attackers: compromising the application or its database can provide access to sensitive communications and identity-related records without first compromising each endpoint.

For administrators, the operational conclusion is direct. Patch to Roundcube 1.6.16 or 1.7.1, or remove virtuser_query until the upgrade can be completed.