Story · 6 sources · 6 articlesfirst Sep 21, 20:20 UTCupdated Sep 25, 10:14 UTC (1d ago)

Roundcube Pre-Auth SQL Injection (CVE-2026-48842) Actively Exploited; 523,000+ Servers Internet-Exposed

highExploit / PoCexploited in the wildimportance 80CVE-2026-48842 CVE-2025-49113 CVE-2025-68461 CVE-2024-37383

What's new: Nothing substantive is new relative to the previous summary (2026-09-25): the same six reports dated September 21-25, 2026 were re-merged, and all key figures — CVSS 8.1, the May 24, 2026 fix date, Shadowserver's 523,000+ exposed instances with 10 flagged vulnerable as of September 23, 2026, and the prior-CVE references — are unchanged. Discrepancies among sources (fix timing: May 24 vs. 'late…

Merged summary · glm-5.3 · rewritten as coverage arrives

Canada's Cyber Centre confirms in-the-wild exploitation of CVE-2026-48842, a pre-authentication SQL injection (CVSS 8.1) in Roundcube Webmail's virtuser_query plugin; fixes shipped May 24, 2026, but Shadowserver counts more than 523,000 exposed instances.

The Canadian Centre for Cyber Security updated advisory AV26-503 on September 21, 2026, citing open-source reporting that CVE-2026-48842 — a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin — is being exploited in the wild, and urged users and administrators to review the linked advisories and install the fixes. The flaw stems from crafted backslash sequences bypassing the escaping filter in PHP's preg_replace(); it requires no valid credentials, and per Cyber Security News it applies to exposed servers where the plugin is enabled. SecurityWeek and The Hacker News rate it CVSS 8.1. Affected versions are 1.6.x before 1.6.16 and 1.7.x before 1.7.1; Cyber Security News and GBHackers report the fixed releases 1.6.16 and 1.7.1 shipped on May 24, 2026, while SecurityWeek dates them only to 'late May' and The Hacker News to May 2026. SOCRadar notes exploitation is occurring months after patches became available but names no victims, versions, or exploitation scale. Exposure figures differ in specificity: The Hacker News cites Shadowserver counting more than 523,000 internet-exposed Roundcube instances, with 10 flagged vulnerable as of September 23, 2026, while SecurityWeek cites over 500,000. Reported impact includes unauthenticated manipulation of backend SQL, database tampering, and access to stored messages, identities, and address books, with potential exposure of mail credentials; GBHackers notes the effect depends on database privileges. Administrators of internet-facing webmail servers are advised to patch immediately, restrict public access, and review logs for signs of SQL abuse. The Hacker News notes previously exploited Roundcube flaws CVE-2025-49113 and CVE-2025-68461; SecurityWeek's coverage additionally references CVE-2024-37383.

CVE-2026-48842 is a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin, caused by a backslash-escaping bypass in PHP's preg_replace(); it requires no login and, per Cyber Security News, affects exposed servers…
SecurityWeek and The Hacker News score the flaw CVSS 8.1.
Affected versions are Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1; fixed releases 1.6.16 and 1.7.1 shipped May 24, 2026 per Cyber Security News and GBHackers, while SecurityWeek says only 'late May'.
Canada's Cyber Centre updated advisory AV26-503 on September 21, 2026, citing open-source reporting of in-the-wild exploitation and urging patching.

VendorsRoundcube

ProductsRoundcube Webmail

Threat actorsUNK_MassTraction

MalwareVShell

OrganizationsCanadian Centre for Cyber Security Shadowserver Foundation CISA SentinelOne Roundcube SOCRadar

CountriesCanada China United States

Coverage timelineoldest first · each row is one article

Sep 21, 20:20 UTC · 5d ago
Canadian Centre for Cyber Security· 72
Roundcube security advisory (AV26-503) – Update 1
Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.
Sep 24, 07:37 UTC · 3d ago
Cyber Security News· 80
Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild
Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.
Sep 24, 09:56 UTC · 2d ago
GBHackers· 78
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication

Vulnerabilities in this storyAll →

CVE-2024-373836.173%
Cross-Site Scripting in Roundcube Webmail via SVG animate attributes
published Jun 7, 2024· Roundcube Webmail KEV
CVE-2025-491138.8

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-37383	Cross-Site Scripting in Roundcube Webmail via SVG animate attributes CVE-2024-37383 is a cross-site scripting vulnerability (CWE-79) in Roundcube Webmail caused by insufficient handling of SVG 'animate' attributes when HTML email content is rendered. An attacker triggers it by sending a crafted HTML email containing a malicious SVG animate element; when the recipient views the message in Roundcube, attacker-controlled JavaScript executes in the context of the victim's webmail session. Successful exploitation allows theft of session cookies and credentials, access to mailbox contents, sending mail as the victim, or redirection to phishing pages, and has been used in campaigns that steal credentials and email. All Roundcube Webmail deployments before 1.5.7 and 1.6.x before 1.6.7 are affected, including Roundcube packages shipped with Debian; because the attack requires only viewing a malicious email, any exposed webmail user is a potential victim. The flaw is under active exploitation: unknown threat actors have used it in phishing campaigns, it carries an EPSS of 73.3%, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-24. Do: Upgrade Roundcube to version 1.5.7 or 1.6.7 (or later) immediately; Debian users should install the updated roundcube package from their repository. Organizations subject to CISA BOD 22-01 must apply vendor mitigations or discontinue use per the KEV entry. Review webmail logs for phishing emails containing SVG animate elements and investigate for credential theft or anomalous mailbox activity.	6.1	73%	KEV	Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 (i.e., 1.6.0 through 1.6.6 and earlier releases) Debian Linux (Roundcube webmail package)	masslikely millions of webmail users across hundreds of thousands of deployed instances, with tens of thousands of instances internet-exposed	Jun 7, 2024 KEV Oct 24, 2024
CVE-2025-49113	Authenticated PHP Object Deserialization RCE in Roundcube Webmail Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 contains a PHP object deserialization flaw (CWE-502) that allows remote code execution by authenticated users. The bug is in program/actions/settings/upload.php, where the _from URL parameter is not validated before deserialization, so any logged-in user can trigger it with a crafted URL to the settings upload action, with no user interaction required. Successful exploitation gives the attacker code execution on the web server with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). All deployments running affected versions are exposed, including Roundcube packages shipped with Debian Linux. The flaw reportedly existed for roughly a decade before disclosure, carries a 98.9% EPSS score (top percentile), and was added to CISA's KEV catalog on 2026-02-20, confirming exploitation in the wild. Do: Upgrade to Roundcube 1.6.11 or 1.5.10 (or later); Debian administrators should install the fixed roundcube package via security updates. Hunt for compromise by reviewing web access logs for requests to the settings upload action with unusual or crafted _from parameters, and check the web server runtime for unexpected processes, files, or webshells. Federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use of the product if mitigations are unavailable.	8.8	99%	KEV PoC ×2
CVE-2025-68461	Cross-Site Scripting via SVG animate Tag in Roundcube Webmail Roundcube Webmail contains a cross-site scripting flaw (CWE-79) that arises when rendering SVG documents, because the SVG 'animate' element is not properly sanitized. An attacker can deliver a crafted SVG document, for example within an email, so that when the recipient views it in the Roundcube web interface, attacker-controlled script executes in the context of the victim's webmail session. Successful exploitation lets the attacker run arbitrary JavaScript in the victim's browser, enabling session hijacking, theft of cookies or credentials, and reading or manipulating the victim's mail and webmail settings. Any organization running Roundcube is potentially affected, including hosting providers, ISPs, universities, and enterprises, where it frequently serves as the default webmail client. CISA added the flaw to the KEV catalog on 2026-02-20, indicating confirmed in-the-wild exploitation, with a 26.8% EPSS probability of exploitation within 30 days (98th percentile); CVSS has not yet been scored and no public proof-of-concept is known. Do: Upgrade Roundcube to the patched release identified in the vendor's security advisory, and for cPanel-managed servers apply the cPanel-shipped Roundcube update; do not defer patching given active exploitation. Until patched, apply vendor-recommended mitigations and hunt mail and web access logs for emails containing SVG content followed by anomalous webmail session activity. Federal agencies must apply the mitigations per vendor instructions or follow BOD 22-01 guidance per the CISA KEV listing.	6.1	27%	KEV	Roundcube Webmail
CVE-2026-48842	Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass. NVD description · AI analysis pending	8.1	<1%	PoC	—	—	May 25, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2024-37383

Cross-Site Scripting in Roundcube Webmail via SVG animate attributes

CVE-2024-37383 is a cross-site scripting vulnerability (CWE-79) in Roundcube Webmail caused by insufficient handling of SVG 'animate' attributes when HTML email content is rendered. An attacker triggers it by sending a crafted HTML email containing a malicious SVG animate element; when the recipient views the message in Roundcube, attacker-controlled JavaScript executes in the context of the victim's webmail session. Successful exploitation allows theft of session cookies and credentials, access to mailbox contents, sending mail as the victim, or redirection to phishing pages, and has been used in campaigns that steal credentials and email. All Roundcube Webmail deployments before 1.5.7 and 1.6.x before 1.6.7 are affected, including Roundcube packages shipped with Debian; because the attack requires only viewing a malicious email, any exposed webmail user is a potential victim. The flaw is under active exploitation: unknown threat actors have used it in phishing campaigns, it carries an EPSS of 73.3%, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-24.

Do: Upgrade Roundcube to version 1.5.7 or 1.6.7 (or later) immediately; Debian users should install the updated roundcube package from their repository. Organizations subject to CISA BOD 22-01 must apply vendor mitigations or discontinue use per the KEV entry. Review webmail logs for phishing emails containing SVG animate elements and investigate for credential theft or anomalous mailbox activity.

6.1

73%

KEV

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 (i.e., 1.6.0 through 1.6.6 and earlier releases)
Debian Linux (Roundcube webmail package)

masslikely millions of webmail users across hundreds of thousands of deployed instances, with tens of thousands of instances internet-exposed

Jun 7, 2024

KEV Oct 24, 2024

CVE-2025-49113

Authenticated PHP Object Deserialization RCE in Roundcube Webmail

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 contains a PHP object deserialization flaw (CWE-502) that allows remote code execution by authenticated users. The bug is in program/actions/settings/upload.php, where the _from URL parameter is not validated before deserialization, so any logged-in user can trigger it with a crafted URL to the settings upload action, with no user interaction required. Successful exploitation gives the attacker code execution on the web server with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). All deployments running affected versions are exposed, including Roundcube packages shipped with Debian Linux. The flaw reportedly existed for roughly a decade before disclosure, carries a 98.9% EPSS score (top percentile), and was added to CISA's KEV catalog on 2026-02-20, confirming exploitation in the wild.

Do: Upgrade to Roundcube 1.6.11 or 1.5.10 (or later); Debian administrators should install the fixed roundcube package via security updates. Hunt for compromise by reviewing web access logs for requests to the settings upload action with unusual or crafted _from parameters, and check the web server runtime for unexpected processes, files, or webshells. Federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use of the product if mitigations are unavailable.

8.8

99%

KEV PoC ×2

CVE-2025-68461

Cross-Site Scripting via SVG animate Tag in Roundcube Webmail

Roundcube Webmail contains a cross-site scripting flaw (CWE-79) that arises when rendering SVG documents, because the SVG 'animate' element is not properly sanitized. An attacker can deliver a crafted SVG document, for example within an email, so that when the recipient views it in the Roundcube web interface, attacker-controlled script executes in the context of the victim's webmail session. Successful exploitation lets the attacker run arbitrary JavaScript in the victim's browser, enabling session hijacking, theft of cookies or credentials, and reading or manipulating the victim's mail and webmail settings. Any organization running Roundcube is potentially affected, including hosting providers, ISPs, universities, and enterprises, where it frequently serves as the default webmail client. CISA added the flaw to the KEV catalog on 2026-02-20, indicating confirmed in-the-wild exploitation, with a 26.8% EPSS probability of exploitation within 30 days (98th percentile); CVSS has not yet been scored and no public proof-of-concept is known.

Do: Upgrade Roundcube to the patched release identified in the vendor's security advisory, and for cPanel-managed servers apply the cPanel-shipped Roundcube update; do not defer patching given active exploitation. Until patched, apply vendor-recommended mitigations and hunt mail and web access logs for emails containing SVG content followed by anomalous webmail session activity. Federal agencies must apply the mitigations per vendor instructions or follow BOD 22-01 guidance per the CISA KEV listing.

6.1

27%

KEV

Roundcube Webmail

CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

NVD description · AI analysis pending

8.1

<1%

PoC

—

May 25, 2026