Canada's Cyber Centre warned on September 25, 2026, that a previously patched Roundcube Webmail flaw is now being actively exploited in the wild. Tracked as CVE-2026-48842 with a CVSS score of 8.1, the issue is a pre-authentication SQL injection in the virtuser_query plugin affecting Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. SentinelOne assessed that unauthenticated attackers can inject arbitrary SQL into Roundcube's database backend, potentially exposing mail account credentials and stored messages without ever logging in.
The root cause is a preg_replace() backslash escape bypass. By crafting input to virtuser_query, an adversary can break out of intended query structure and steer database calls. Because Roundcube is frequently internet-facing as webmail for governments, universities and enterprises, a successful injection becomes a shortcut to sensitive correspondence, password hashes and session data. Shadowserver counted more than 523,000 Roundcube instances exposed online as of September 23, 2026, with ten hosts still flagged vulnerable to this CVE — a small absolute gap, but critical for laggards.
Roundcube has long attracted state-aligned and criminal actors hunting diplomatic and corporate email. In July 2026, Proofpoint described how suspected China-aligned UNK_MassTraction exploited known Roundcube flaws to deploy web shells and the VShell post-exploitation tool. In February 2026, CISA already listed CVE-2025-49113 and CVE-2025-68461 as actively exploited in the same product family. The new alert on CVE-2026-48842 shows that patched-but-unupgraded servers remain open doors months after the vendor shipped fixes — Roundcube released 1.6.16 and 1.7.1 in May 2026.
For Nordic organisations the risk is concrete: many municipalities, universities and SMEs run Roundcube behind simple reverse proxies. SQL access can enable mailbox exfiltration, session cookie regeneration or backdoor database accounts. Canada's advisory cites open-source reporting without publishing IoCs, making version inventory and log review the first line of defence. Administrators should verify the version string, upgrade to at least 1.6.16 or 1.7.1, and restrict HTTP access to authenticated networks or VPN where feasible. Email remains one of the richest digital evidence sources — and therefore a priority target.
How to protect mail servers and users
1. Upgrade every Roundcube node to 1.6.16 or 1.7.1 (or newer) without delay. 2. If virtuser_query is unused, disable the plugin until the patch is verified. 3. Limit public webmail access via IP allowlists, an SSO gateway or mTLS. 4. Review database and web logs for suspicious SQL fragments and auth anomalies since May 2026. 5. Rotate mailbox passwords and revoke sessions if compromise is suspected; enable MFA where supported.
Evidence Rail
- Confirmed: Canadian Centre for Cyber Security active-exploitation warning; Roundcube patches 1.6.16/1.7.1; SentinelOne technical description.
- Reported: Shadowserver exposure counts; prior UNK_MassTraction Roundcube campaigns (Proofpoint).
- Unconfirmed: Specific threat actor behind the current CVE-2026-48842 wave.
In Brief
- Pre-auth SQL injection in Roundcube virtuser_query is actively exploited despite a May patch.
- More than 500,000 public Roundcube instances remain online — unpatched nodes are high risk.
- Immediate upgrades, plugin minimisation and log triage are required for exposed webmail.