HIGH: Roundcube CVE-2026-48842 SQL Injection Now Exploited in the Wild

If you run webmail, you already know the drill. Attackers love the inbox because that's where the password reset links, the invoices, the contracts and the "quick favor" emails from the CFO all live. So when a pre-authentication bug in Roundcube starts getting exploited, it is worth putting down the coffee and checking your servers before the rest of the morning gets away from you.

On September 21, 2026, the Canadian Centre for Cyber Security updated its advisory AV26-503 with a short but important line. Open-source reporting, it said, indicates that CVE-2026-48842 is being exploited in the wild. The flaw is a pre-authentication SQL injection in the virtuser_query plugin that ships with Roundcube Webmail. It carries a CVSS score of 8.1, and it affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The fix has been out since May 24, 2026. That means attackers were working with a bug that had been public for roughly 120 days, which says less about their skill and more about how long patches sit in the queue on self-hosted mail servers.

What Is Actually Broken

Roundcube is the open-source webmail client that quietly runs behind an enormous number of hosting control panels, university mail systems, government mailboxes and small business mail servers. It is the kind of software nobody thinks about until it breaks, which is precisely why it keeps showing up in threat reports.

The virtuser_query plugin exists to solve a fairly mundane problem. Some mail setups need to map an email address to a login name, or a login name back to an email identity, by running a SQL query against a lookup table. Administrators write that query into the plugin configuration with a placeholder, and the plugin swaps in the user supplied value at runtime. Because that mapping has to happen before the user is logged in, the code path runs pre-authentication by design.

The bug sits in how that substitution was sanitized. The plugin relied on PHP's preg_replace() to build the final query, and the escaping of backslashes could be bypassed. In plain terms, a carefully crafted value submitted at the login stage could break out of the intended string context and append arbitrary SQL to the query the server sends to its database. The researcher credited in the Roundcube release notes, who goes by skull, reported it as a preg_replace backslash escape bypass, and that description is about as tidy as SQL injection gets.

What an attacker can do next depends heavily on the database account Roundcube uses. SentinelOne's summary of the impact notes that unauthenticated attackers can inject SQL into the Roundcube database backend and potentially expose mail account credentials and stored messages. In practice, that database often holds user records, identities, address books, cached message data and session information. If the lookup table used by virtuser_query lives in the same database as your mail user directory, or if the database account has broader rights than it should, the blast radius grows quickly. A read primitive against a mail backend is a very good day for anyone running a credential harvesting or espionage operation.

The Important Caveat

Here is the good news, and it is genuinely good news. The vulnerable code only matters if the virtuser_query plugin is actually turned on. Roundcube does not load a plugin simply because its folder exists on disk. It has to be listed in the plugins array in config/config.inc.php, and the virtuser_query setting has to be configured with a query. A default installation that never touched this plugin is not exposed through this particular path.

That caveat explains the modest numbers from the Shadowserver Foundation. Shadowserver sees more than 523,000 Roundcube instances exposed to the internet, but as of September 23, 2026 it had flagged only a small handful as confirmed vulnerable hosts. That does not mean everyone else is safe. It means the specific configuration is uncommon, and it is exactly the kind of uncommon configuration you find in older hosting environments, custom mail platforms and the server a contractor set up in 2019 that nobody has logged into since.

Do not read "only a few confirmed vulnerable hosts" as permission to wait. The Roundcube 1.6.16 and 1.7.1 releases fixed eight security issues, not one. Alongside the SQL injection, the same release closed a pre-authentication arbitrary file deletion bug reachable through redis or memcache session poisoning, an SSRF bypass, a stored XSS in the draft restore dialog, a CSS injection trick using SVG animation, two remote resource blocking bypasses and a code evaluation issue in the LDAP autovalues option. If you are behind on this patch, you are behind on all of them.

Roundcube Keeps Getting Picked On

This is not a one-off. Roundcube has been a favorite target for years, and 2026 has been busy. In February, CISA added CVE-2025-49113 and CVE-2025-68461 to its Known Exploited Vulnerabilities catalog. In July, researchers tracked a suspected China-aligned cluster dubbed UNK_MassTraction exploiting Roundcube flaws to drop web shells and the VShell remote access tool. Go back a little further and you find APT28 and Winter Vivern both building operations around Roundcube bugs against government and military mail systems in Europe.

The pattern is consistent. Webmail is internet facing, often unmonitored, frequently hosted by someone other than the organization that depends on it, and it sits directly on top of the most sensitive communications a business has. Nation-state crews like it for espionage. Criminal crews like it because a mailbox is the fastest route to business email compromise. Nobody has published indicators tying CVE-2026-48842 activity to a named group yet, and the Canadian advisory did not share attack details, so treat attribution talk you see on social media with the usual skepticism.

What To Do Right Now

Start by finding every Roundcube instance you are responsible for, including the ones hiding inside cPanel, Plesk, DirectAdmin, ISPConfig and similar hosting stacks. Check the version string in the installer output, the program/include/iniset.php file or the About dialog. Anything on the 1.6 branch below 1.6.16, or on the 1.7 branch below 1.7.1, needs to be upgraded. If your control panel vendor bundles Roundcube, confirm that their update actually pulled in the fixed release rather than assuming it did.

Next, check whether virtuser_query is enabled. Open config/config.inc.php and look at the plugins array and for any virtuser_query setting. If the plugin is enabled and you do not have a clear business reason for it, remove it from the plugins list today. That alone closes this specific door even before the upgrade lands, though you should still upgrade because of the other seven fixes.

While you are in there, look at the database account Roundcube uses. It should have rights only to the Roundcube schema and whatever lookup table the plugin genuinely needs. It should not be able to read your mail server's full user directory, and it certainly should not have FILE privileges or administrative rights on the database server. Least privilege will not stop the injection, but it decides whether a successful injection is an annoyance or an incident.

For detection, pull your web server access logs for requests to the Roundcube login flow that contain unusual quoting, stacked backslashes, SQL keywords like UNION or SLEEP, or unusually long username values. Pair that with your database logs and look for errors or unexpected queries arriving at times that do not line up with a successful login. PHP error logs showing SQL syntax errors from the virtuser_query code path are a strong signal that someone has been testing. If you find evidence of exploitation, assume the Roundcube database contents are exposed, rotate the credentials for the Roundcube database account, force password resets for affected mailboxes and check for new mail forwarding rules or identities that users did not create.

A web application firewall rule for SQL injection patterns on the login endpoint is a reasonable stopgap if you cannot patch this week. It is a stopgap, though. WAFs are good at catching lazy payloads and not great at catching someone who has read the patch diff.

Finally, if a hosting provider runs your webmail, ask them directly which Roundcube version they are on and whether virtuser_query is enabled. You are allowed to ask. You are paying them.

The Bigger Lesson

The frustrating part of this story is not the bug. SQL injection in a string substitution routine is an old mistake, and the Roundcube team fixed it quickly and disclosed it clearly. The frustrating part is the four month gap between the fix and the exploitation warning, and the certainty that many of the exposed servers will still be unpatched a month from now. Webmail tends to fall into a gap in ownership. The hosting provider thinks the customer handles application updates, the customer thinks the host does, and the attacker is happy to settle the argument for both of them.

Put every webmail and mail-adjacent web application on your asset inventory with a named owner and a patch window. Treat pre-authentication bugs in anything internet facing as critical regardless of what the CVSS score says. And the next time a Roundcube advisory lands, do not wait for the "exploited in the wild" update to act on it.

MSP Angle

Plenty of your clients have webmail they have forgotten about, usually tucked inside a legacy hosting account or a panel nobody logs into. Offer a quick external attack surface review focused on mail and webmail, then roll the findings into a managed patching and email security package so this becomes a recurring service instead of a one-time scramble.