Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild

A critical security issue affecting Roundcube Webmail is now being exploited in the wild, prompting administrators to update exposed installations urgently.

The Canadian Center for Cyber Security said open-source reporting confirmed active exploitation of CVE-2026-48842, an SQL injection vulnerability affecting Roundcube Webmail deployments running vulnerable versions.

Roundcube published security advisories on May 24, 2026, addressing multiple flaws in its open-source webmail platform. The affected releases include Roundcube Webmail versions before 1.6.16 in the long-term support branch and versions before 1.7.1 in the newer release branch.

Canada’s Cyber Center updated advisory AV26-503 on September 21, 2026, warning that attackers are abusing CVE-2026-48842. The vulnerability is described as a pre-authentication SQL injection flaw in Roundcube’s virtuser_query plugin.

The issue stems from a bypass involving backslash escaping in the PHP preg_replace function. An attacker may be able to send specially crafted input to manipulate a database query before successfully logging in to the webmail application.

Roundcube Webmail SQL Injection Vulnerability Exploited

Pre-authentication bugs are especially serious because an attacker does not need valid user credentials to begin an attack. If the vulnerable plugin is enabled and reachable, exploitation could allow an attacker to interfere with database operations or access information that should remain protected.

Roundcube’s 1.6.16 security release specifically fixes the SQL injection issue in the virtuser_query plugin. The project said the update is intended for production installations in the 1.6.x branch and recommended that organizations back up their data before applying it.

The move from a disclosed vulnerability to confirmed exploitation increases the urgency for organizations operating Roundcube Webmail.

Internet-facing email platforms are valuable targets because they can expose user identities, messages, address books, authentication workflows, and administrative functions.

Attackers commonly target webmail servers to gain an initial foothold, collect credentials, steal sensitive communications, or support later phishing and business email compromise operations. Public exploit activity also increases the chance that opportunistic attackers will scan the internet for unpatched Roundcube instances.

Administrators should immediately identify all Roundcube installations, including systems maintained by third-party hosting providers or managed service partners.

Organizations should verify the installed release, determine whether the virtuser_query plugin is enabled, and upgrade to Roundcube Webmail 1.6.16 or 1.7.1 as appropriate.

Security teams should apply the vendor updates as soon as possible and prioritize any Roundcube server exposed directly to the internet.

They should also review web-server, application, database, and authentication logs for unusual requests, failed database queries, unexpected error messages, or suspicious activity involving Roundcube endpoints.

Organizations should restrict administrative access, enforce multi-factor authentication where supported, maintain tested backups, and ensure Roundcube database accounts have only the minimum required permissions.

Network monitoring teams should investigate unusual outbound traffic or suspicious mailbox access after a suspected compromise.

The Canadian Center for Cyber Security has encouraged users and administrators to review the available Roundcube advisories and apply the required updates without delay.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC