Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.
The Canadian Centre for Cyber Security warned that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin, is being actively exploited. The CVSS 8.1 bug affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1 and comes from a preg_replace() backslash escape bypass that lets unauthenticated attackers inject SQL, potentially exposing mail credentials and stored messages. Roundcube patched it in May 2026. Shadowserver counted more than 523,000 internet-exposed Roundcube instances, with 10 flagged vulnerable as of September 23, 2026. Prior exploited Roundcube flaws include CVE-2025-49113 and CVE-2025-68461.
- CVE-2026-48842 is a pre-auth SQL injection, CVSS 8.1, now exploited.
- Patches shipped in Roundcube 1.6.16 and 1.7.1 in May 2026.
- Injection could expose mailbox credentials and stored messages.
- Shadowserver saw over 523,000 exposed instances; 10 were flagged vulnerable.
- Earlier bugs CVE-2025-49113 and CVE-2025-68461 were also exploited.
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Threat actors
- UNK_MassTraction
- Malware
- VShell
- Countries
- CanadaChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2025-68461 | Cross-Site Scripting via SVG animate Tag in Roundcube Webmail | 6.1 | 27% | KEV | KEV |
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
1 min read at thehackernews.com
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8. 1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.