Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild
Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.
The Canadian Centre for Cyber Security warned on September 21 that CVE-2026-48842, a pre-authentication SQL injection in Roundcube's virtuser_query plugin, is being exploited in the wild. The flaw, CVSS 8.1, affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1; fixes shipped on May 24, 2026. Attackers can bypass preg_replace backslash escaping and reach the database, potentially exposing mailbox credentials and messages. Earlier Roundcube bugs CVE-2025-49113 and CVE-2025-68461 were already listed in CISA's Known Exploited Vulnerabilities catalog.
- Canadian cyber center says CVE-2026-48842 is exploited in the wild.
- Pre-auth SQL injection sits in the virtuser_query plugin.
- Affected builds are below 1.6.16 and 1.7.1; patched in May.
- Database access may expose mailbox credentials and messages.
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Threat actors
- UNK_MassTraction
- Malware
- VShell
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-68461 | Cross-Site Scripting via SVG animate Tag in Roundcube Webmail | 6.1 | 27% | KEV | KEV |
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | <1% | PoC ×3 |
From the original article
3 min read at securityaffairs.comRoundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of database compromise. A Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVSS score of 8. 1) and patched four months ago, is now being exploited in the wild.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.