Attackers are exploiting a Roundcube SQL injection vulnerability that the Webmail project patched in May 2026, according to the Canadian Centre for Cyber Security. The flaw affects a plugin that connects Roundcube to a database for user lookups.
Flaw Affects the virtuser_query Plugin
The vulnerability, CVE-2026-48842, affects Roundcube’s built-in virtuser_query plugin. This plugin uses database queries to match users with email addresses.
An attacker can attempt to exploit the flaw before signing in. A successful attack could let them run malicious database commands, bypass authentication and access data in the Roundcube database. Exploitation is complex, but it does not require a user to click a link or take another action.
Roundcube released fixes in versions 1.6.16 and 1.7.1 and urged administrators to update their servers.
Canadian Cyber Centre Warns of Attacks
In September, the Canadian Centre for Cyber Security updated its earlier advisory. It said open-source reporting showed that attackers were exploiting CVE-2026-48842 in the wild.
The advisory did not identify the attackers or describe how many servers they had compromised. It urged administrators to secure affected installations.
Shadowserver tracks more than 523,000 Roundcube instances exposed to the internet. That figure represents visible installations, not the number vulnerable to this specific flaw. The available data does not show how many have received the fix.
Administrators Can Patch or Disable the Plugin
Administrators should update Roundcube to a fixed version. If they cannot upgrade immediately, they can disable or remove the virtuser_query plugin to close this attack path.
This Roundcube SQL injection warning follows several other cases of attackers exploiting Webmail vulnerabilities. Earlier in 2026, CISA flagged two separate Roundcube flaws as actively exploited.
0 responses to “Hackers Exploit Critical Roundcube SQL Injection Flaw”