Shadowserver now tracks over 523,000 Roundcube instances exposed on the Internet — and one of the webmail client’s highest-severity bugs, CVE-2026-48842, is being used against them, the Canadian Centre for Cyber Security warned.
CVE-2026-48842: a pre-authenticated SQL injection in the virtuser_query plugin
Roundcube’s security team patched CVE-2026-48842 in May, describing the flaw as "a pre-authenticated SQL injection in the virtuser_query built-in plugin," the component that handles database-driven user lookups and maps users to email addresses. According to the published description, successful exploitation can allow threat actors with no privileges to bypass authentication, inject and execute malicious database commands, and steal data from Roundcube’s database. The attacks are described as high complexity and not requiring user interaction.
Canadian Centre for Cyber Security: active exploitation reported
On Monday, four months after the May patch, the Canadian Centre for Cyber Security updated its advisory to warn that attackers are now actively exploiting the flaw. "Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," the Cyber Centre said, and urged administrators to secure their webmail servers. The advisory points to the immediate availability of a security update to block ongoing attacks and reiterates a mitigation for administrators who cannot immediately upgrade: disable or remove the virtuser_query plugin to eliminate the attack vector.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScale and exposure: Roundcube, cPanel, and more than half a million endpoints
Roundcube Webmail is a browser-based IMAP client used as the default mail interface by thousands of services with millions of users, and it ships pre-installed with the widely used cPanel web hosting control panel. That makes the software broadly distributed across hosting providers and enterprise environments. The threat-monitoring nonprofit Shadowserver now tracks over 523,000 Roundcube instances that are exposed to the Internet. The data point comes with an important caveat: there is no information reported about how many of those instances are honeypots or have already been patched against CVE-2026-48842.
Historic targeting: previous Roundcube exploitation by named groups and U.S. agency warnings
Roundcube security flaws have a history of attracting both cybercrime and state-backed actors. The report cites Winter Vivern (TA473), a Russian threat group, which exploited an XSS zero-day (CVE-2023-5631) in attacks that targeted European government entities. It also notes that the Russian APT28 group abused multiple Roundcube vulnerabilities — CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026 — to breach Ukrainian government email systems. In February, the U.S. Cybersecurity and Infrastructure Security Agency flagged two other Roundcube flaws (CVE-2025-49113 and CVE-2025-68461) as actively exploited, and ordered government agencies to secure their networks within three weeks. Since May 2022, CISA has tagged 11 Roundcube Webmail vulnerabilities as exploited in the wild.
What this means for technologists, hosting providers, and policymakers
- Technologists and security teams: Apply the Roundcube security update that patches CVE-2026-48842 — Roundcube "strongly" recommended upgrading to versions 1.6.16 and 1.7.1 — or, if immediate upgrade is impossible, disable or remove the virtuser_query plugin as the Cyber Centre advises.
- Hosting providers and cPanel administrators: Because Roundcube is commonly pre-installed with cPanel, hosting operators should verify the versions deployed on customer-facing mail interfaces and prioritize patching exposed instances that Shadowserver identifies.
- Policymakers and network defenders in government: The Canadian Centre’s public advisory and CISA’s earlier directive in February establish recent precedents for rapid, agency-driven reminders and requirements; agencies should confirm inventories of exposed Roundcube instances and follow the mitigation steps laid out in official advisories.
There is a ready fix and a clear mitigation path: upgrade to Roundcube versions 1.6.16 or 1.7.1, or remove the virtuser_query plugin if an immediate upgrade isn’t possible. What remains uncertain — and consequential — is how many of the more than 523,000 internet-exposed Roundcube installations are already patched, intentionally monitored as honeypots, or still vulnerable. That number will determine whether today’s advisory is a containment of isolated incidents or the opening salvo of a much larger data-theft campaign.
