Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild
Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.
The Canadian Centre for Cyber Security says attackers are actively exploiting CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin. The flaw, caused by a backslash-escaping bypass in PHP preg_replace, affects versions before 1.6.16 and 1.7.1 and was fixed in advisories published on May 24, 2026. Advisory AV26-503 was updated on September 21, 2026, after open-source reporting confirmed exploitation. Unauthenticated attackers may manipulate database queries on exposed servers where the plugin is enabled.
- CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin.
- Affected releases are Roundcube before 1.6.16 and before 1.7.1.
- Canada’s Cyber Centre confirmed active exploitation in updated advisory AV26-503.
- The bug is a backslash-escaping bypass in PHP preg_replace.
- Internet-facing webmail servers should be patched and logs reviewed.
- CVEs
- CVE-2026-48842
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
2 min read at cybersecuritynews.com
A critical security issue affecting Roundcube Webmail is now being exploited in the wild, prompting administrators to update exposed installations urgently. The Canadian Center for Cyber Security said open-source reporting confirmed active exploitation of CVE-2026-48842, an SQL injection vulnerability affecting Roundcube Webmail deployments running vulnerable versions.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.