Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
CVE-2026-48842 (CVSS 8.1) is an unauthenticated SQL injection in Roundcube's virtuser_query plugin, where crafted backslash sequences bypass the preg_replace() escaping filter. The Canadian Centre for Cyber Security says open-source reporting indicates the flaw is being exploited in the wild. Roundcube fixed the issue in versions 1.6.16 and 1.7.1 released in late May; Shadowserver data shows over 500,000 internet-accessible Roundcube servers, and successful attacks allow database tampering and access to messages, identities, and address books.
- CVE-2026-48842: unauthenticated SQL injection, CVSS 8.1, in virtuser_query plugin
- Canadian Cyber Centre reports active in-the-wild exploitation
- Patched in Roundcube 1.6.16 and 1.7.1 (late May)
- Over 500,000 Roundcube servers reachable from the internet
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-37383 | Cross-Site Scripting in Roundcube Webmail via SVG animate attributes | 6.1 | 74% | KEV | KEV |
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2025-68461 | Cross-Site Scripting via SVG animate Tag in Roundcube Webmail | 6.1 | 27% | KEV | KEV |
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
1 min read at securityweek.com
Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication. The post Roundcube Webmail Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.