Roundcube SQL injection flaw now exploited in attacks

Attackers are exploiting a high-severity SQL injection vulnerability in Roundcube Webmail that was patched in May, according to the Canadian Centre for Cyber Security.

The flaw, tracked as CVE-2026-48842, sits in virtuser_query, a plugin that ships with Roundcube. The plugin handles user lookups against a database and maps users to their email addresses. The Roundcube security team described the bug as a pre-authenticated SQL injection, which means an attacker does not need to log in to reach it.

Roundcube Webmail is an open-source, browser-based email client that talks to mail servers over IMAP. Thousands of services use it as their default mail interface, and it has millions of users. It also comes pre-installed with cPanel, a popular control panel that hosting providers give customers to manage websites and email.

What the flaw allows

An attacker with no privileges who exploits the bug can bypass authentication, inject and run malicious database commands, and pull data out of Roundcube's database. No user interaction is required. The attacks are rated as high complexity, so they are not trivial to pull off.

When it released the fix in May, Roundcube "strongly" recommended that administrators move to versions 1.6.16 or 1.7.1. Both releases close the hole.

The number of potentially exposed servers is large. Shadowserver, a non-profit that monitors internet threats, tracks more than 523,000 Roundcube instances reachable from the internet. It is not clear how many of these are honeypots, meaning decoy systems set up to watch attackers, or how many have already been updated.

Canadian agency updates its advisory

On Monday, four months after the patch came out, the Canadian Centre for Cyber Security revised its original May advisory. The agency, part of Canada's signals intelligence body, now warns that the vulnerability is being used in real attacks.

"Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," the Cyber Centre said. It urged administrators to secure their webmail servers.

The advisory does not describe who is behind the attacks or which organisations have been targeted.

Upgrading remains the recommended fix. Administrators who cannot update right away should disable or remove the virtuser_query plugin, which removes the attack vector altogether.

A long history of Roundcube abuse

Roundcube has drawn attention from both cybercriminals and state-backed hacking groups for years.

Winter Vivern, a Russian threat group also tracked as TA473, used a cross-site scripting (XSS) zero-day, CVE-2023-5631, against European government bodies. APT28, a Russian cyber-espionage group, abused three older flaws (CVE-2020-35730, CVE-2020-12641 and CVE-2021-44026) to get into Ukrainian government email systems.

This year brought more activity. In February, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two further Roundcube bugs, CVE-2025-49113 and CVE-2025-68461, to its list of actively exploited vulnerabilities. It gave federal agencies three weeks to secure their systems.

Since May 2022, CISA has marked 11 Roundcube Webmail vulnerabilities as exploited in the wild.

What admins should do now

For anyone running Roundcube, the steps are straightforward:

• Check which version is installed and upgrade to 1.6.16 or 1.7.1.
• If an upgrade is not possible right away, disable or remove the virtuser_query plugin.
• Hosting providers using cPanel should confirm whether the bundled Roundcube has been updated on their servers.

Because the bug can expose database contents, administrators who ran vulnerable versions while the plugin was enabled may also want to review their logs and database access for signs of misuse. The advisory does not share specific indicators of compromise.

Our Take

The four-month gap between the patch and the exploitation warning is the key detail here. It suggests that attackers do not need fresh zero-days when a large pool of internet-facing servers stays unpatched. With more than half a million Roundcube instances visible online, even a small share of neglected installations gives attackers plenty of targets.

The history matters too. Russian groups have repeatedly turned to Roundcube to reach government mailboxes, and CISA's count of 11 exploited Roundcube bugs since 2022 shows this is a recurring pattern rather than a one-off. Webmail sits close to sensitive communications, which makes it an attractive target for both espionage and data theft.

The cPanel connection is worth watching. Many smaller organisations rely on their hosting provider to keep bundled software current, and some may not know Roundcube is running at all. It is also worth watching whether CISA adds CVE-2026-48842 to its catalogue of exploited flaws, and whether more details emerge about who is using it and against whom.