Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Cyber Centre Warns of Active Exploitation Against Patched Roundcube Flaw

The Canadian Centre for Cyber Security (Cyber Centre) has updated its advisory AV26-503 to warn that CVE-2026-48842, a now-patched pre-authentication SQL injection vulnerability in Roundcube Webmail, is being actively exploited in the wild. The Cyber Centre added the exploitation notice on Monday, September 21, 2026, stating that "open-source reporting indicates that CVE-2026-48842 is being exploited in the wild." The flaw, carrying a CVSS score of 8.1, resides in the virtuser_query plugin bundled with Roundcube and was originally patched back in May 2026, meaning organizations that have not yet updated have had roughly four months of exposure before this warning went public.

Roundcube is one of the most widely deployed open-source webmail platforms, and threat monitoring nonprofit Shadowserver Foundation tracks more than 523,000 Roundcube instances exposed to the internet, with at least 10 vulnerable hosts flagged as of September 23, 2026. Separately, cyber insurer Coalition reported observing exploitation attempts against its own honeypot infrastructure. As of the September 24, 2026 catalog release, CVE-2026-48842 had not yet been added to CISA's Known Exploited Vulnerabilities (KEV) list, which already contains 11 other Roundcube flaws — underscoring that Roundcube webmail deployments remain a recurring target for both financially motivated and state-backed threat actors.

Incident Details

How the Flaw Works

A preg_replace() Backslash Escape Bypass

CVE-2026-48842 is not a simple failure to sanitize input. According to technical write-ups from security researchers, Roundcube's virtuser_query plugin — which handles database-driven lookups that map authenticated users to their underlying email accounts — first passes user-supplied credentials through the database driver's $dbh->escape() sanitization function. The resulting, escaped string is then run through PHP's preg_replace() function, which reinserts backslash characters intended to protect SQL metacharacters. The problem is that backslashes carry a different contextual meaning inside preg_replace() than they do in a raw SQL string, and that mismatch allows a specially crafted input to bypass the escaping that had just been applied. The net effect is that an attacker with no credentials can inject arbitrary SQL statements into queries the plugin sends to Roundcube's backend database, entirely before any authentication check occurs.

Exploitation Is Conditional, Not Automatic

Importantly, exploitation does not happen merely because a server runs a vulnerable Roundcube version. Roundcube ships with virtuser_query disabled by default — the plugin only becomes exposed on installations where an administrator has explicitly enabled it and configured its SQL lookup queries, which is common on multi-domain or virtual-hosting mail setups that map many email addresses to shared mailbox accounts. That configuration requirement narrows the exposed population relative to Roundcube's full install base, but the more than half a million internet-facing Roundcube instances tracked by Shadowserver still represent a substantial attack surface to search for vulnerable configurations.

No Confirmed Attribution Yet

No public reporting has tied the current exploitation activity to a specific threat actor. Roundcube has previously been targeted by state-sponsored groups, including Russia-linked Winter Vivern and APT28, in past campaigns against unrelated Roundcube vulnerabilities, but no source has connected those groups — or any other named actor — to the exploitation of CVE-2026-48842 specifically.

Impact Assessment

Recommendations

For System Administrators

• Upgrade Roundcube Webmail to 1.6.16, 1.7.1, or later immediately; the current releases (1.6.19 and 1.7.4) bundle numerous additional security fixes issued since May 2026 and are the recommended targets rather than the minimum patched versions.
• Audit your Roundcube plugin configuration to determine whether virtuser_query is enabled. If your deployment does not require it — most single-domain installations do not — disable it to eliminate the exposed code path entirely.
• If virtuser_query is required for multi-domain or virtual-hosting mail routing, prioritize patching over configuration workarounds, since disabling the plugin is not viable for those environments.
• Apply the principle of least privilege to the database account Roundcube uses. Restricting that account's permissions will not close the SQL injection itself, but it limits what an attacker can do if exploitation succeeds.

For Security Teams

• Review web-server, PHP, Roundcube, and database logs for unusual unauthenticated requests targeting login or user-lookup endpoints, as well as repeated or abnormal database query errors that could indicate injection attempts.
• Treat internet-facing Roundcube instances with virtuser_query enabled as a priority hunt target, especially given confirmed exploitation attempts reported against Coalition's honeypot network.
• Monitor CISA's KEV catalog for CVE-2026-48842's eventual addition — its absence as of September 24, 2026, does not indicate the threat is any less real, only that it hasn't yet met CISA's listing criteria.
• Cross-reference any suspicious Roundcube database activity against known indicators from prior Roundcube campaigns tied to Winter Vivern and APT28, even though no attribution has been confirmed for this specific CVE.

Key Takeaways

1. CVE-2026-48842 is a pre-authentication SQL injection (CVSS 8.1) in Roundcube Webmail's virtuser_query plugin, patched in May 2026 with versions 1.6.16 and 1.7.1.
2. The Canadian Centre for Cyber Security updated advisory AV26-503 on September 21, 2026, warning of active exploitation based on open-source reporting.
3. The root cause is a preg_replace() backslash escape bypass that undermines Roundcube's own SQL sanitization, not a total absence of input escaping.
4. Exploitation requires virtuser_query to be enabled and configured — a non-default setting — narrowing but not eliminating the risk across the more than 523,000 internet-facing Roundcube instances Shadowserver tracks.
5. The flaw is not yet on CISA's KEV list as of September 24, 2026, despite confirmed exploitation attempts reported by Coalition against its honeypot network.
6. Organizations should update to the latest Roundcube releases (1.6.19 / 1.7.4) rather than the bare minimum patched versions, and disable virtuser_query where it isn't operationally required.

Sources

• Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild — The Hacker News
• AV26-503 Roundcube Webmail Advisory — Canadian Centre for Cyber Security