Old Roundcube webmail bug now exploited — update this week

Your webmail login page is the most public thing your mail team owns. A Roundcube bug patched back in May is now being exploited, and it doesn’t need a password.

If the virtuser_query plugin is switched on, this is this week’s job, not next quarter’s.

“Patched in May” only counts if your server actually took the patch.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

CVE-2026-48842 is a pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin. The plugin maps email addresses to mailbox users with a database query, and a backslash-escape bypass in its preg_replace() cleanup lets raw SQL reach the database.

It affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Fixes shipped May 24, 2026.

On Monday, September 21, the Canadian Centre for Cyber Security updated its May advisory: “Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.” BleepingComputer reported the change on September 24. The CNA scores it 8.1 (high attack complexity, no privileges, no user interaction).

Why it matters

Roundcube comes pre-installed with cPanel and fronts mail for thousands of providers. Shadowserver tracks more than 523,000 Internet-exposed Roundcube instances; not all are vulnerable or use the plugin. The database behind webmail holds users, sessions, and settings, which is useful for taking over mailboxes and moving further in.

Roundcube is a repeat favorite. CISA has tagged 11 Roundcube vulnerabilities as exploited since May 2022, and groups including Winter Vivern and APT28 have used Roundcube bugs against government mail. Mail infrastructure keeps drawing SQL injection, too: the Cisco email gateway bug earlier this month went from SQL to root.

What to do first

1. Upgrade to Roundcube 1.6.16 or 1.7.1 (or later).
2. Can’t upgrade today? Disable or remove the virtuser_query plugin. That removes the attack path.
3. Check exposure: look in your Roundcube config for virtuser_query to see whether you were ever exposed.
4. On shared or managed hosting? Ask your provider which Roundcube version they run and whether the plugin is on.
5. If you were exposed: review web and database logs, and consider resetting webmail sessions.

Details

• CVE: CVE-2026-48842: pre-auth SQL injection (CWE-89) in virtuser_query
• Affected: Roundcube Webmail 1.6.x < 1.6.16; 1.7.x < 1.7.1
• Fixed: 1.6.16 and 1.7.1 (May 24, 2026)
• CVSS (CNA): 8.1, AV:N/AC:H/PR:N/UI:N
• Exploitation: Canadian Centre for Cyber Security advisory updated 2026-09-21. Not in CISA KEV as of Sep 24, 2026.

Hunt / verify

• Confirm the version (About box, or RCMAIL_VERSION in program/include/iniset.php).
• Look for login and lookup requests with odd backslash sequences or SQL keywords in the username field.
• Check database logs for errors or unusual queries from the Roundcube database user around login time.
• Layered filtering helps with the phishing that follows a mailbox takeover; see our guide to email security tools.

Slack paste: Roundcube → 1.6.16 / 1.7.1 or disable virtuser_query; check config; ask the host if it’s managed.

Mail and webmail bugs that get exploited show up in the CyberExperts Daily Brief each weekday morning, with the fix in one line.

Sources

• BleepingComputer: Hackers now exploit critical Roundcube flaw (Sep 24, 2026)
• NVD: CVE-2026-48842
• SecurityOnline: CVE-2026-48842 exploited in the wild

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.