Reported by 17 outlets
CVE-2026-48842 Exploited Roundcube Webmail SQL Injection
Why this score
- Breadth
- 2.00 / 2.0 · 17 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 2.20 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-48842 is a pre-authentication SQL injection vulnerability (CVSS 8.1) in Roundcube Webmail's virtuser_query plugin, which performs database-backed mappings between usernames and email addresses. The root cause is a preg_replace() backslash-escape bypass that allows attackers to inject SQL without authentication. The flaw was fixed in versions 1.6.16 and 1.7.1 on May 24, 2026.
Multiple reports indicate active exploitation in the wild months after patches became available. The Canadian Centre for Cyber Security updated its advisory on September 21 to confirm open-source reporting of exploitation. The new Mastodon event from September 29 reinforces that attackers can access mailboxes without authentication via SQL injection. The event content confirms this is a real, actively exploited vulnerability rather than a theoretical exposure.
What to watch: additional victim reports, CISA KEV listing, and whether Roundcube releases further hardening guidance for the virtuser_query plugin.
Timeline
-
original reporting
An exploited Roundcube Webmail vulnerability allows SQL injection attacks. Learn how CVE-2026-48842 impacts servers and apply the latest pat
securityonline.info · 20d ago · September 24th, 2026
An exploited Roundcube Webmail vulnerability allows SQL injection attacks. Learn how CVE-2026-48842 impacts servers and apply the latest pat
via Mastodon https://securityonline.info/exploited-roundcube-webmail-vulnerability-cve-2026-48842/?utm_source=mastodon&utm_medium=jetpack_social
-
update from roundcube.net
Security updates 1.6.16 and 1.7.1 released
roundcube.net · 143d ago · May 24th, 2026
The vendor published the 1.6 LTS and 1.7 security updates on May 24, 2026. The fix list includes a pre-auth SQL injection in the virtuser_query plugin via a preg_replace backslash escape bypass, reported by skull, alongside stored XSS, SSRF bypass, and pre-auth arbitrary file delete via redis/memcache session poisoning. The project strongly recommended updating all productive 1.6.x and 1.7.x installations.
-
update from github.com
Roundcube Webmail 1.6.16 (GitHub release)
github.com · 143d ago · May 24th, 2026
The signed 1.6.16 tag was released by maintainer Aleksander Machniak (alecpl) on May 24, 2026, GPG-verified the same day. The release bundles eight security fixes for the 1.6 LTS branch.
-
update from nist.gov
NVD detail for CVE-2026-48842
nist.gov · 142d ago · May 25th, 2026
The NVD record was published May 25, 2026, one day after the vendor release. MITRE assigned CVSS 3.1 base score 8.1 HIGH with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-89, affecting Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The record references two fix commits in the roundcubemail repository.
-
update from debian.org
[SECURITY] [DSA 6301-1] roundcube security update
debian.org · 139d ago · May 27th, 2026
Debian issued DSA-6301-1 on May 27, 2026, fixing CVE-2026-48842 and seven companion CVEs (CVE-2026-48843 through CVE-2026-48849) in the roundcube package. Fixed versions were 1.6.5+dfsg-1+deb12u9 for bookworm and 1.6.16+dfsg-0+deb13u1 for trixie.
-
update from openwall.com
CVE-2026-48842+more: Roundcube numerous vulnerabilities prior to 1.6.16/1.7.1
openwall.com · 132d ago · June 3rd, 2026
Valtteri Vuorikoski posted the 1.6.16/1.7.1 fix list to the oss-security mailing list on June 3, 2026, noting the vendor announcement carried no CVE ids and pointing to the Debian security tracker for the mapping. The post also observed that support for the 1.5 LTS branch had ended, leaving it presumably vulnerable to some or all of the fixed issues.
-
update from cyberpress.org
Hackers Exploit Roundcube Webmail SQL Injection Flaw Without Authentication
cyberpress.org · 19d ago · September 24th, 2026
Threat actors are actively exploiting a critical SQL injection vulnerability in Roundcube Webmail that can be triggered without authentication. Tracked as CVE-2026-48842, the flaw affects Roundcube Webmail versions earlier than 1.6.16 and 1.7.1. The Canadian Center for Cyber Security confirmed that open-source reporting has identified exploitation in the wild, elevating the urgency for organizations that use Roundcube as an internet-facing email platform. Hackers Exploit Roundcube Webmail SQL Injection Flaw The advisory, identified as AV26-503 Update 1 and updated on September 21, follows Roundcube’s May 24 security release. While the public notice does not provide technical exploitation details, the vulnerability’s unauthenticated nature makes it especially significant. Attackers do not need a valid mailbox, user password, or existing session to exploit a vulnerable server. SQL injection weaknesses occur when an application fails to safely handle input incorporated into database queries. A successful attack can allow an adversary to alter the intended database operation, potentially exposing sensitive records, bypassing application-level controls, or enabling further compromise depending on the application’s configuration and database privileges. For Roundcube deployments, the risk extends beyond the webmail interface itself. Email platforms commonly handle user account information, address books, session data, message metadata, configuration settings, and authentication-rel
-
update from gbhackers.com
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
gbhackers.com · 19d ago · September 24th, 2026
A highly severe vulnerability in Roundcube Webmail is being actively exploited, posing risks to unpatched email servers through unauthenticated SQL injection attacks. On September 21, the Canadian Center for Cyber Security updated advisory AV26-503, warning that reports from the […] The post Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from bleepingcomputer.com
Hackers now exploit critical Roundcube flaw in code injection attacks
bleepingcomputer.com · 19d ago · September 24th, 2026
Roundcube Webmail is a browser-based IMAP email client used as the default mail interface by thousands of services with millions of users, and it is pre-installed with the widely used cPanel web hosting control panel. In May, the Roundcube security team patched the flaw (tracked as CVE-2026-48842 ), describing it as a pre-authenticated SQL injection in the virtuser_query built-in plugin, which handles database-driven user lookups and maps users to email addresses. Successful exploitation can let threat actors with no privileges bypass authentication, inject and execute malicious database commands, and steal data from Roundcube's database in high-complexity attacks that don't require user interaction. Threat monitoring non-profit Shadowserver now tracks over 523,000 Roundcube instances exposed on the Internet. However, there is no information on how many are honeypots or have already been patched against this flaw.
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-48842: pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin, patched in May (1.6.16/1.7.1), now actively exploited
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-48842: pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin, patched in May, now actively exploited. No privileges
www.bleepingcomputer.com · 18d ago · September 25th, 2026
-
update from securityweek.com
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
securityweek.com · 18d ago · September 25th, 2026
The plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts. CVE-2026-48842, however, allows attackers to bypass the protection by using crafted queries containing backslash sequences that defeat the plugin’s regular-expression escaping mechanism. The attacker’s malicious input invokes the virtuser_query plugin to traverse the preg_replace() filter, resulting in quote characters being concatenated into an SQL string that is sent to the database, SentinelOne explains . As Paymob information security lead Omar Ahmed points out , successful exploitation of the bug allows attackers to tamper with database operations, access protected information,
-
mentioned by dev.to
Roundcube CVE-2026-48842: Active Exploitation Reported for Pre-Authentication SQL Injection in virtuser_query # security # threatintel # sof
dev.to · 18d ago · September 25th, 2026
-
mentioned by cyberworldops.eu
Canadian Centre for Cyber Security warns CVE-2026-48842, a pre-auth SQL injection in Roundcube Webmail virtuser_query plugin, is actively ex
cyberworldops.eu · 18d ago · September 25th, 2026
-
update from malware.news
Roundcube SQLi (CVE-2026-48842) Exploited
malware.news · 18d ago · September 25th, 2026
What Is CVE-2026-48842? In simplified terms, input used during the lookup process can bypass an expected escaping mechanism and influence the resulting SQL query.
-
mentioned by thehackernews.com
🤖 CVE-2026-48842 (CVSS 8.1): pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin, actively exploited in the wild per Canadia
thehackernews.com · 18d ago · September 25th, 2026
-
mentioned by www.bleepingcomputer.com
Hackers now exploit critical # Roundcube flaw in code injection attacks https://www. bleepingcomputer.com/news/secu rity/critical-roundcube-
www.bleepingcomputer.com · 18d ago · September 25th, 2026
-
mentioned by linuxmint.hu
Warning: fixed CVE-2026-48842 Roundcube vulnerability actively exploited; unauthenticated SQL injection grants mailbox access
linuxmint.hu · 14d ago · September 29th, 2026
-
update from www.linux-magazin.de
Attacks on Roundcube webmail are increasing. Roundcube is an open-source webmail application that lets users read emails directly in the browser,
www.linux-magazin.de · 14d ago · September 29th, 2026
Roundcube is an open-source webmail application that lets users read emails directly in the browser,
via Mastodon https://www.linux-magazin.de/news/angriffe-auf-roundcube-webmail-nehmen-zu/
-
update from beyondmachines.net
Roundcube Webmail SQL Injection Vulnerability CVE-2026-48842 Under Active Exploitation Roundcube Webmail high-severity SQL injection vulnera
beyondmachines.net · 9d ago · October 4th, 2026
Roundcube Webmail SQL Injection Vulnerability CVE-2026-48842 Under Active Exploitation Roundcube Webmail high-severity SQL injection vulnera
via Mastodon https://beyondmachines.net/event_details/roundcube-webmail-sql-injection-vulnerability-cve-2026-48842-under-active-exploitation-o-t-j-p-f/gD2P6Ple2L