"Unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages," SentinelOne said.
CVE-2026-48842: pre-auth SQL injection in the virtuser_query plugin
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability — CVE-2026-48842 (CVSS score: 8.1) — is being actively exploited in the wild. The flaw is a pre-authentication SQL injection in the virtuser_query plugin affecting Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1.
Technical root cause: a preg_replace() backslash escape bypass
The vulnerability stems from a preg_replace() backslash escape bypass that permits attackers to inject arbitrary SQL statements without authenticating to the application. That bypass is the specific enabling condition allowing unauthenticated SQL injection into Roundcube's database backend via the virtuser_query plugin.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePatches and timeline: fixes issued in May 2026
Roundcube released patches for the flaw in May 2026 as part of versions 1.6.16 and 1.7.1. Those releases close the preg_replace() escape bypass exploited by CVE-2026-48842.
Exposure and observed exploitation: Canadian Cyber Centre and Shadowserver data
In an update shared this week, the Canadian Centre for Cyber Security said the security flaw is being actively exploited in the wild, citing open-source reporting; the Centre did not disclose additional details about the exploitation. Separately, data from the Shadowserver Foundation shows more than 523,000 Roundcube instances exposed to the internet, with 10 of them flagged as vulnerable hosts as of September 23, 2026.
Related activity: web shells, VShell, and earlier Roundcube exploitation
Roundcube has been a recurring target for actors seeking to harvest sensitive email communications. In July 2026, Proofpoint reported that it had identified a suspected China-aligned adversary dubbed UNK_MassTraction exploiting known Roundcube security flaws to deliver web shells or a post-exploitation tool called VShell. Earlier, in February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) tagged two other Roundcube vulnerabilities — CVE-2025-49113 and CVE-2025-68461 — as actively exploited.
What this means for system administrators, incident responders, and email users
- System administrators and technologists: the fixed releases are 1.6.16 and 1.7.1 (May 2026). Given the preg_replace() escape bypass at the core of CVE-2026-48842, administrators running affected versions should align their installations with those patched releases.
- Incident responders and threat hunters: the active-exploitation notice from the Canadian Centre for Cyber Security, combined with Proofpoint's July 2026 findings about delivery of web shells and VShell, underscores the need to search for indicators consistent with SQL injection and post-exploitation artifacts on Roundcube instances.
- Email users and those with mail stored on Roundcube servers: SentinelOne's assessment explicitly warns that injected SQL could expose mail account credentials and stored messages, placing account privacy and message contents at potential risk.
Roundcube administrators now have a narrow but clear record to work from: a high-severity, pre-auth SQL injection (CVE-2026-48842) was patched in May 2026; the Canadian Centre for Cyber Security says exploitation is occurring; and open-source scans show hundreds of thousands of internet-exposed instances with a small number still flagged as vulnerable as of September 23, 2026. The public facts stop there — the provenance and scale of the active exploitation cited by the Cyber Centre remain tied to open-source reporting and have not been further detailed.
