Roundcube SQL Injection Flaw Under Active Attack

Canada’s Canadian Centre for Cyber Security updated its advisory Wednesday to confirm that CVE-2026-48842, a SQL injection in Roundcube Webmail patched four months ago, is now being actively exploited. If you run Roundcube on any public-facing server and have not patched since May, move this to the top of your queue.

The flaw

CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin, which Roundcube uses to map virtual usernames to real mailbox accounts via database lookups. An unauthenticated attacker can inject malicious SQL through that code path to bypass the login screen and read from or modify Roundcube’s backend database. No user interaction is required.

CVSS score is 8.1 (high). Roundcube released fixes in versions 1.6.16 and 1.7.1 in May 2026.

Four months, now exploited

The CCCS originally issued guidance in May when the patches landed. Its September 24 update notes that “open-source reporting indicates that CVE-2026-48842 is being exploited in the wild,” without naming specific threat actors or the scale of exploitation. The pattern is familiar: a patch sits uninstalled for months, and eventually someone starts scanning for unpatched instances.

Roundcube sees particularly heavy use in government, higher-education, and shared hosting environments, the same sectors that tend to move slowly on webmail upgrades. Earlier this year a China-aligned cluster used separate Roundcube flaws to target university physics departments, so this platform has been on threat-actor radar for a while.

What to do

Upgrade. Roundcube 1.6.16 and 1.7.1 both address CVE-2026-48842. The upgrade path is standard and the patched versions are stable.

If patching must wait: disabling or removing the virtuser_query plugin removes the attack vector, but only if your deployment does not rely on virtual-user routing. Verify the impact before disabling in a live environment.

Check your Roundcube version with php roundcube/index.php --version or from the admin panel. Anything below 1.6.16 or 1.7.1 is exposed.

This is one of several cases this week where exploitation started long after patches were available, a pattern that came up in the InfraTrust report on network management systems and in the Zyxel and Veeam KEV confirmations from earlier this week. Old patches, new exploitation: the calendar does not protect you, only the patch does.