Roundcube Webmail SQL Injection CVE-2026-48842 Now Exploited in Attacks

Industry News  ·  October 6, 2026  ·  By Oreaxe Editorial Team

A Roundcube vulnerability tracked as CVE-2026-48842, a pre-authentication SQL injection flaw in the webmail client, is now being exploited, and Singapore’s Cyber Security Agency (CSA) told administrators on October 3, 2026, to update immediately. The Roundcube vulnerability was fixed back on May 24, so any webmail server still on an older build has been sitting on a known, fixed flaw for more than four months.

It only bites installations that use the optional virtuser_query plugin. Where that plugin is active, an attacker needs no account and no click from a user to reach the database behind your email.

At a glance

What happenedA pre-auth SQL injection in Roundcube’s virtuser_query plugin is being exploited in the wild
Who’s affectedRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, with the virtuser_query plugin enabled
SeverityHigh; CVSS 3.1: 8.1
StatusPatched May 24, 2026; exploitation reported since September 21, 2026; not in CISA’s KEV catalog as of Greenbone’s September 24 write-up
What to do nowUpdate to the current 1.6.19 or 1.7.4, disable the plugin if unused, then review logs

What happened

Roundcube shipped versions 1.6.16 and 1.7.1 on May 24, 2026, fixing eight security issues. One of them, credited to a researcher using the name “skull,” was a pre-auth SQL injection in the virtuser_query plugin that abused how preg_replace handled backslash escaping.

The picture changed on September 21, when the Canadian Centre for Cyber Security updated its advisory AV26-503 to say open-source reporting showed the Roundcube vulnerability being exploited. Greenbone reported that Coalition had seen exploitation attempts against its honeypot.

Singapore followed on October 3 with alert AL-2026-131, which lists 1.6.0 through 1.6.15 and 1.7.0 as affected. Greenbone noted on September 24 that CISA had not added the CVE to its Known Exploited Vulnerabilities (KEV) catalog. None of the advisories we reviewed name a threat actor, so the activity is unattributed.

How the Roundcube vulnerability works

The virtuser_query plugin runs a database lookup that turns an email address into a mailbox username, and it does this before the user has logged in. Field Effect notes that because the lookup runs before authentication, exploitation needs no valid credentials.

Escaping was supposed to neutralize hostile input. According to Security Affairs, specially crafted input built around backslash sequences defeats that escaping, so part of what the attacker types lands inside the SQL statement rather than being handled as data. Greenbone describes the same root cause: backslashes are processed differently in later function calls, which undoes the protection from $dbh->escape().

What an attacker can read or change then depends on the database rights the Roundcube account holds. Field Effect lists user information, email-related data and address books among the possible exposures. In our view the bigger danger is what comes next, with harvested mailbox data feeding invoice fraud or targeted phishing.

Why it matters for small businesses

Field Effect notes that Roundcube is typically run by organizations that host their own email. If you reach it through a hosting account or an IT provider, it is still a server that somebody has to patch. If your staff log in to email on a Roundcube-branded page, somebody is responsible for its version number. Find out who.

Field Effect points out that contracts, customer records and financial details routinely travel by email, which is what makes webmail worth attacking for fraud and credential theft. Security Affairs warns that, depending on how the database is set up, exploitation could expose mailbox credentials and stored messages. Roundcube has been abused before: Greenbone lists past espionage campaigns against government, military and think-tank targets in Europe and university departments in the US and Canada.

On jurisdiction: if you find evidence that personal data was exposed, get advice on notification duties for each country involved, since rules differ between the UK, the EU, the US and Pakistan. Client contracts may add their own notice requirements, so check them too.

What to do now

  1. Check the Roundcube version in your admin panel or ask your host. Versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 are affected when the virtuser_query plugin is enabled.
  2. Update. Roundcube’s current stable releases are 1.6.19 and 1.7.4, published September 6, 2026, which also close a dozen later issues, including a zero-click stored XSS. Going straight there beats stopping at 1.6.16.
  3. Look in the Roundcube config for virtuser_query among the enabled plugins. If you don’t need it, disable it, but still update.
  4. Patching won’t reveal a past compromise. Review web server and database logs for login requests containing unusual backslashes, quotes or SQL keywords. Security Affairs notes there are no confirmed indicators yet, so treat oddities as leads, not proof.
  5. Give the Roundcube database account only the permissions it needs, as Field Effect recommends, to limit what an injection can reach.
  6. If you find signs of access, reset mailbox passwords and warn clients to confirm any change in payment details by phone.

MFA won’t block this Roundcube vulnerability, but if mailbox credentials may have leaked, a second factor stops a stolen password alone from opening the account; our comparison of MFA tools for small merchants is a practical starting point, and 7 Cyber Threats Every Small Business Should Plan For covers business email compromise in more depth.

Oreaxe’s take

This is the pattern we’d most like small businesses to internalize: a high-severity Roundcube vulnerability, publicly fixed in May, becomes an active threat in September while unpatched servers are still online. The patch was never the hard part. Knowing that you run Roundcube, and on which version, was.

Our view is that self-hosted webmail only makes sense for a small team if someone checks the project’s security news monthly and can update within days. If that’s not you, move mail to a provider that patches for you, and keep whatever you self-host behind a VPN or an allow-list rather than open to the whole internet.

Watch CISA’s KEV catalog too. In our view, a listing there would be the cue to assume wider scanning.

Sources

Every factual claim links to its source. Spotted an error? Tell us.

OT
Written byOreaxe Editorial TeamMore from Oreaxe Editorial Team →
Scroll to Top