What happened
A pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is now being actively exploited in the wild.
The flaw lives in the virtuser_query plugin, where a backslash-escaping bypass in a PHP preg_replace() call lets an attacker submit specially crafted input that manipulates the underlying database query — before ever logging in. Because no valid credentials are required, any reachable, vulnerable instance is a target.
Roundcube shipped fixes in versions 1.6.16 and 1.7.1, but confirmed in-the-wild exploitation means unpatched systems are being probed and compromised now, not just theoretically at risk.
Why it matters
Webmail platforms sit at the center of an organization's identity and communications: mailboxes, address books, authentication workflows, and administrative functions all pass through them. A successful SQL injection against Roundcube can hand attackers a foothold to harvest credentials, read sensitive communications, or set up business email compromise and phishing campaigns launched from a trusted domain.
Once a disclosed bug moves to confirmed exploitation, opportunistic scanning for unpatched instances typically follows fast, so the exposure window closes quickly for organizations that don't act.
What to do
- Inventory every Roundcube deployment, including instances run by hosting providers or managed service partners.
- Check whether the
virtuser_queryplugin is enabled and confirm the installed version. - Upgrade to Roundcube 1.6.16 or 1.7.1, backing up mail and database data before applying the update.
- Review web server, application, database, and authentication logs for unusual queries, failed logins, or unexpected errors tied to Roundcube endpoints.
- Enforce multi-factor authentication where supported, restrict administrative access, and limit database account permissions to the minimum required.
- Watch for unusual outbound traffic or unexpected mailbox access that could indicate a prior compromise.