CVE-2026-48842

A pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is being actively exploited in the wild. The flaw exists in the virtuser_query plugin of versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allowing unauthenticated attackers to inject arbitrary SQL and potentially access mail account credentials and stored messages. The Canadian Centre for Cyber Security and SentinelOne have confirmed active exploitation, though specific threat actor details remain limited. Patches were released in May 2026, but over 500,000 Roundcube instances remain internet-exposed, with at least 10 identified as vulnerable as of late September 2026.

A critical pre-authenticated SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is now being actively exploited in the wild. The flaw exists in the virtuser_query plugin and allows unauthenticated attackers to bypass authentication, execute malicious database commands, and steal data without user interaction. The Canadian Centre for Cyber Security has issued an updated advisory warning of ongoing exploitation, urging administrators to update to patched versions 1.6.16 or 1.7.1, or disable the vulnerable plugin if immediate patching is not possible. Roundcube instances have been frequent targets in the past, including by state-backed groups such as APT28 and TA473.