Roundcube SQLi (CVE-2026-48842) Exploited

A pre-authentication SQL injection vulnerability in Roundcube Webmail is reportedly being exploited in the wild months after patches became available.

Tracked as CVE-2026-48842, the flaw affects Roundcube’s virtuser_query plugin and was fixed in versions 1.6.16 and 1.7.1 on May 24, 2026. On September 21, the Canadian Centre for Cyber Security updated its advisory to state that open-source reporting indicated exploitation in the wild.

What Is CVE-2026-48842?

CVE-2026-48842 (CVSS 8.1) is a pre-authentication SQL injection vulnerability (classified as CWE-89) in Roundcube’s virtuser_query plugin, which performs database-backed mappings between usernames and email addresses.

Roundcube describes the root cause as a preg_replace() backslash-escape bypass. In simplified terms, input used during the lookup process can bypass an expected escaping mechanism and influence the resulting SQL query. Roundcube fixed the issue as part of its May 24 security updates for versions 1.6.16 and 1.7.1.

Successful exploitation could allow an attacker to execute unauthorized SQL operations with the permissions available to Roundcube’s database account. Depending on the deployment, that may expose, modify, or disrupt application database data.

However, CVE-2026-48842 should not automatically be described as an operating system-level Remote Code Execution (RCE) vulnerability. Available reporting establishes SQL injection; any further impact depends on the database configuration, privileges, and surrounding environment.

Which Roundcube Versions Are Affected?

The official CVE record identifies the following affected versions:

The CVE record specifically lists the 1.6 and 1.7 branches. It does not identify Roundcube 1.5.x as affected by CVE-2026-48842.

Administrators should preferably upgrade beyond the minimum patched versions. Roundcube has since released 1.6.19 and 1.7.4, both published on September 6, 2026.

Is Every Roundcube Installation Vulnerable?

No. The vulnerable code is located in the virtuser_query plugin, and Roundcube plugins are not active simply because their files are present.

Roundcube’s documentation states that a plugin must be explicitly enabled in the local plugins configuration before it is loaded. The default plugin list is empty. The virtuser_query plugin provides database-backed user-to-email and email-to-user lookups.

A potentially exposed environment therefore generally requires:

• An affected Roundcube 1.6.x or 1.7.x release.
• The virtuser_query plugin to be enabled.
• Vulnerable functionality to be reachable by the attacker.
• Sufficient database privileges for the injected query to have meaningful impact.

This distinction matters when prioritizing remediation, but it should not be used as a reason to delay upgrades. Roundcube’s May releases also addressed several other security vulnerabilities and the project recommended updating all production installations in the affected branches.

How Could CVE-2026-48842 Be Exploited?

An attacker could target an exposed Roundcube installation before authenticating. If virtuser_query is enabled and attacker-controlled input reaches the vulnerable lookup logic, the escaping flaw can cause part of that input to be interpreted as SQL rather than ordinary data.

The resulting impact is constrained by the permissions of the database account used by Roundcube. A narrowly scoped database user may limit what can be accessed, while excessive database privileges can substantially increase the consequences.

This is also why claims of direct mailbox compromise require caution. Roundcube is an IMAP webmail client, and its application database is not necessarily where message contents are stored. SQL injection against Roundcube’s database does not by itself prove access to the underlying mail server or every user’s email.

Is CVE-2026-48842 Being Exploited?

Exploitation has been reported, although publicly available details remain limited.

The Canadian Centre for Cyber Security updated its Roundcube security advisory on September 21 to state that open-source reporting indicates CVE-2026-48842 is being exploited in the wild. At present, specific details regarding threat actors, targeted victims, regional patterns, attack metrics, or subsequent post-exploitation behaviors remain unconfirmed.

With exploitation now being reported months after the original fix, organizations should identify vulnerable internet-facing Roundcube installations and monitor for changes in exploit activity.

SOCRadar’s Cyber Threat Intelligence (CTI) module can help teams follow CVE-2026-48842, exploitation developments, and related threat intelligence, while Attack Surface Management (ASM) can provide visibility into externally exposed Roundcube assets. Combining vulnerability intelligence with asset exposure data can help teams determine which systems require the fastest remediation.

What Should Defenders Do?

Upgrade Roundcube

Upgrade affected 1.6.x deployments to at least 1.6.16 and 1.7.x deployments to at least 1.7.1. Where possible, move directly to the latest supported maintenance release for the deployed branch.

Verify the running version after installation rather than assuming the package manager, container image, or hosting platform has already deployed the fix.

Check Whether virtuser_query Is Enabled

Review the Roundcube plugin configuration and determine whether virtuser_query is active and required.

If the plugin is unnecessary, disabling it can reduce exposure. Organizations that depend on it should prioritize upgrading rather than relying on configuration changes alone.

Review Database Permissions

Confirm that Roundcube’s database account follows the principle of least privilege. It should have only the permissions needed for normal application functionality.

Restricting database privileges cannot fix CVE-2026-48842, but it can reduce the potential impact of successful SQL injection.

Hunt for Suspicious Activity

For systems that remained exposed after May 24, review web-server, PHP, Roundcube, and database logs for:

• Unusual unauthenticated requests around login or user-lookup activity.
• Repeated database errors or abnormal query failures.
• Unexpected database reads, modifications, or schema access from the Roundcube account.
• Unusual authentication behavior or newly created application data.
• Suspicious changes to Roundcube plugins, configuration files, or PHP files.
• Activity from the same source followed by abnormal account sessions or administrative access.

These are hunting hypotheses rather than confirmed indicators of compromise. SQL injection activity may not leave an obvious signature in standard web logs, so database auditing and application telemetry can provide important additional context.

Organizations should prioritize internet-facing Roundcube systems that run vulnerable releases with virtuser_query enabled. Patching closes the vulnerability, but systems exposed before the update should also be reviewed for signs of prior exploitation.