Roundcube’s SQL injection flaw is now actively exploited, four months after the patch

May 2026. The Roundcube team patches CVE-2026-48842, a pre-authentication SQL injection in the virtuser_query plugin, and “strongly” recommends upgrading to 1.6.16 and 1.7.1. Four months later. The Canadian Centre for Cyber Security updates its May advisory to confirm the flaw is being exploited in the wild. September 24, 2026. Shadowserver tracks more than 523,000 Internet-exposed Roundcube instances. Why it matters: Roundcube is the default mail interface for thousands of services — and it ships pre-installed with cPanel, one of the most widely used hosting control panels on the planet.

The flaw: SQL injection before authentication

CVE-2026-48842 sits in the built-in virtuser_query plugin, which handles database-driven user lookups and maps users to email addresses. It is a pre-authentication SQL injection: the attacker needs no privileges to reach it.

The consequences are severe. Successful exploitation lets an attacker bypass authentication, inject and execute malicious database commands, and steal data from the Roundcube database — accounts, credentials, address books, logs. The attack is rated high complexity and requires no user interaction, which makes it trivially scriptable at scale: once the vector is public, a scanner is enough to target exposed instances.

The fix has existed since May 2026. The fact that active exploitation is only being flagged four months later is the textbook alarm of the unapplied patch window: the flaw was known, documented and fixed — yet still present on tens of thousands of servers.

A webmail at the heart of shared hosting

Roundcube is no niche webmail. It is a browser-based IMAP client used as the default mail interface by thousands of services and millions of users. Above all, it ships pre-installed with cPanel, meaning every hoster that offers email boxes to its customers is potentially deploying Roundcube by default.

That position multiplies the flaw’s severity. On a shared hosting server, the Roundcube database centralizes the information of every mail account on the box. A successful SQL injection does not compromise one user: it compromises the whole database. The attacker who exfiltrates it leaves with the credentials, addresses and metadata of every tenant — a direct springboard into fraud, targeted phishing and chained account takeover.

Shadowserver’s 523,000 exposed instances give the order of magnitude. The number does not say how many are still vulnerable or how many are honeypots, but it is a reminder that Roundcube belongs to that class of component you install and forget — while it sits directly exposed to the Internet.

A recurring target for state and criminal actors

This exploitation does not come from nowhere. Roundcube has been a recurring target for years, for both state-backed groups and cybercrime. In 2023, the Russian Winter Vivern (TA473) group exploited an XSS zero-day (CVE-2023-5631) against European government entities. Before that, APT28 — tied to Russian military intelligence — chained several flaws (CVE-2020-35730, CVE-2020-12641, CVE-2021-44026) to breach Ukrainian government email systems.

The trend has not cooled. In February 2026, CISA added two further Roundcube flaws (CVE-2025-49113 and CVE-2025-68461) to its KEV catalog, ordering federal agencies to remediate within three weeks. And since May 2022, the agency has tagged eleven Roundcube vulnerabilities as exploited in the wild. The message is plain: an Internet-facing webmail is a first-choice entry point, and attackers know it.

The parallel with the immediate news is instructive. On the same day this exploitation is documented, other webmails and management panels are under comparable campaigns — WordPress, TeamCity, Check Point — following the same logic: a patched but unapplied flaw becomes, months later, the vector of a campaign.

Patch and verify

The fix is an upgrade to Roundcube 1.6.16 or 1.7.1 at minimum. The verification, however, must go beyond a version number.

# Identify the installed version (system package or manual install)
rpm -qa 2>/dev/null | grep -i roundcube || dpkg -l 2>/dev/null | grep -i roundcube

# For a manual install, read the version constant from the source tree
grep -r "RCMAIL_VERSION" /var/www/*/roundcubemail/program/include/iniset.php 2>/dev/null

# Disable the vulnerable plugin if an upgrade is impossible
# Edit config/config.inc.php and remove virtuser_query from $config['plugins']

The second command matters: Roundcube is often deployed manually (downloaded and dropped into a vhost), so it does not always show up in the package manager, and updates do not apply themselves. That is exactly why the flaw persists four months after the fix.

The Canadian Centre recommends that anyone who cannot upgrade immediately disable or remove the virtuser_query plugin to eliminate the attack vector. It is an effective stopgap: the injection lives in that plugin, and removing it neutralizes the flaw even on an unpatched version.

Detecting an already-compromised instance

The patch stops the attack, but it does not repair a database that has already been exfiltrated. After upgrading, look for traces of past exploitation — an SQL injection abused for weeks leaves signatures in the logs and in the database.

# Anomalous requests to the user-lookup engine in the web logs
grep -E "virtuser_query|_task=login" /var/log/*/roundcube* /var/log/httpd/*_log 2>/dev/null | tail -50

# Accounts present in the users table (compare against the expected list)
mysql -e "SELECT user_id, username, last_login FROM roundcubemail.users ORDER BY user_id;" 2>/dev/null

# Database objects modified recently
mysql -e "SELECT * FROM information_schema.tables WHERE table_schema='roundcubemail' AND update_time > NOW() - INTERVAL 30 DAY;" 2>/dev/null

Three signals should trigger an immediate investigation: logins from unexpected IP addresses, accounts created or modified without legitimate action, and anomalous SQL queries in the web or database logs. If any is present, the reflex is the same as for any mail compromise: rotate credentials for every account after restoring a clean database, and do not reuse a backup taken after exploitation began, or you will re-import the backdoor.

It is also the moment to tighten the posture around the webmail: put it behind an additional authentication layer, restrict its exposure to trusted IP addresses where possible, and enable log monitoring that turns the next attempt into an alert instead of a late discovery.

Verdict

CVE-2026-48842 is the case study in the patch window: a pre-authentication SQL injection fixed in May 2026, exploited in the wild by September. If you host a Roundcube webmail, check your version and your exposed instances today — move to 1.6.16 or 1.7.1, or disable virtuser_query within the hour. If you run a cPanel server, assume Roundcube is present and exposed by default: the mail database it guards belongs to all your customers, not one. And take the structural lesson: a pre-installed, exposed component you never inventory is a security debt that gets paid, one day, as a collective incident.

References

• BleepingComputer — Hackers now exploit critical Roundcube flaw in code injection attacks (September 24, 2026)
• NVD — CVE-2026-48842
• Canadian Centre for Cyber Security — Roundcube advisory