virtuser_query plugin that ships with Roundcube Webmail, and it affects the 1.6.x branch before 1.6.16 and the 1.7.x branch before 1.7.1. Roundcube patched it on May 24, 2026. The Cyber Centre added its exploitation warning on September 21. Administrators who have gone four months without patching now face an exploited, unauthenticated route into the webmail database, although the only servers exposed are those with the plugin turned on. The warning itself is short, but Roundcube is common on hosting servers and has been attacked many times before, so the right response is to find every instance and update it.
Cyber Centre Advisory AV26-503 Flags Roundcube CVE-2026-48842 as Exploited
The Cyber Centre first issued advisory AV26-503 on May 25, 2026, the day after Roundcube's release. It listed Roundcube Webmail versions before 1.6.16 and before 1.7.1 as affected. On September 21 the Centre published "Update 1", which says that open-source reporting indicates CVE-2026-48842 is being exploited in the wild, and it asks users and administrators to apply the updates. BleepingComputer covered the change on September 24. Other security outlets reported the same thing, including GBHackers, which wrote that Roundcube released the fixed versions on May 24, 2026, and afterward the Canadian Cyber Center confirmed that CVE-2026-48842 was under active exploitation.
The warning gives very little detail. The Cyber Centre does not name the attackers, the victims, when attacks started, how large the campaign is, or what exploit technique is being used. It is a government agency pointing to other people's reporting. It is not publishing its own incident analysis. That is still enough to move the bug from "patch when convenient" to "patch now", but defenders should not expect ready-made indicators of compromise to arrive with it.
The flaw's status in CISA's Known Exploited Vulnerabilities (KEV) catalog is less clear. OpenCVE's record, generated back in May, says this CVE is not in the KEV list, and that record may predate the Canadian update. No U.S. listing has been confirmed so far. Organizations that schedule patches around KEV entries should not wait for one before acting.
How a preg_replace() Escape Bypass in virtuser_query Opens the Database Before Login
virtuser_query is one of the plugins bundled with Roundcube. It looks up users in a database so that email addresses can be mapped to mailbox accounts. SentinelOne's vulnerability write-up describes how it works: the plugin resolves email addresses to mailbox usernames by substituting user-supplied values into a configured SQL query template, and attempts to neutralize injection attempts using preg_replace() with backslash escaping. That escaping is where it breaks. Attackers can bypass that sanitization by crafting input containing backslash sequences that defeat the regex-based escape, allowing raw SQL fragments to reach the database driver.
The attack works before login because of where the plugin runs. According to SentinelOne, because the affected code path is exercised during login or account lookup, no valid credentials are required to trigger it. GBHackers makes the same point: an attacker does not need valid mailbox credentials, passwords, session tokens, or any other account-level access.
The configuration condition matters just as much. The OpenCVE record says the issue affects installations of Roundcube Webmail version 1.6.x before 1.6.16 and version 1.7.x before 1.7.1 when the virtuser_query plugin is enabled. A vulnerable version number on its own does not mean a server can be exploited. The plugin also has to be enabled, and an attacker has to be able to reach it. That condition is the main thing to check when triaging a list of hosts.
CVE-2026-48842 Is SQL Injection, Whatever the "Code Injection" Headline Says
Some coverage describes the attacks as "code injection". The record does not support that. The CVE is classified as CWE-89, improper neutralization of SQL command elements, and the CVE description says Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass. No authoritative source says the bug gives operating-system command execution. Roundcube's May release did fix a separate code-injection issue involving LDAP autovalues, which may explain the mixed-up wording, but that is a different bug.
SQL injection before login is still serious. The record scores it at 8.1, which indicates high severity. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, the attack comes over the network, needs no privileges and no user interaction, and could have high impact on confidentiality, integrity and availability. The "AC:H" part means high attack complexity: the scorers judged that success depends on conditions the attacker does not fully control. Having the plugin enabled is one of those conditions.
If an attack succeeds, the database is exposed. OpenCVE's summary says the flaw can enable an attacker to query, modify, or delete data stored in the mail server's database. SentinelOne adds that attackers could end up potentially exposing mail account credentials and stored messages. How much damage is possible depends on the server. As GBHackers puts it, the impact varies depending on the database configuration and the privileges assigned to the Roundcube database account. A Roundcube database account with narrow permissions limits the damage. One with broad permissions does not.
Why Roundcube 1.6.16 and 1.7.1 Are Now the Floor, Not the Target
Roundcube shipped 1.6.16 for the 1.6 LTS branch and 1.7.1 for the 1.7 branch on the same day, May 24, 2026. The project said it strongly recommends updating every production installation on either branch. Most security write-ups still cite those two versions as the fix. GBHackers, for example, advises readers to upgrade 1.6.x installations to version 1.6.16 or later, or 1.7.x installations to version 1.7.1 or later.
The words "or later" are important. Roundcube has released more security updates since May: 1.6.17 and 1.7.2, then 1.6.18 and 1.7.3, and on September 6 it published 1.6.19 and 1.7.4, again recommending that production systems update. An administrator who patches a May-era server today should go straight to the newest release on their branch. Stopping at 1.6.16 or 1.7.1 would close CVE-2026-48842 and leave every bug fixed since then open.
The May releases also fixed several unrelated flaws. According to Roundcube's notice, these included:
- A stored XSS/HTML/CSS injection in the subject field of the draft-restore dialog.
- A bypass of the HTML sanitizer's CSS filtering using SVG
<animate attributeName="style">. - SSRF bypasses via specific local-address URLs, and a local/private URL fetch bypass when remote resources were disallowed.
- A remote-image blocking bypass using CSS
var(). - A pre-auth arbitrary file deletion through Redis or Memcache session poisoning.
- A code-injection issue in the LDAP autovalues option, which Roundcube fixed by removing support for code evaluation there.
None of these is CVE-2026-48842, and the Cyber Centre's exploitation warning is about that CVE only. A server that is still on a pre-May version is exposed to all of them.
Packaged installations add a complication. Snyk's Debian entry notes that the fixed build on Debian 13 is version 1.6.16+dfsg-0+deb13u1 or higher, and warns that versions mentioned in the description apply only to the upstream roundcube package and not the roundcube package as distributed by Debian. On distribution or control-panel installs, check the vendor's own package version or advisory. Distributions often backport fixes, so the upstream version string may not tell you whether you are patched.
Roundcube's Exploitation History Explains Why Four Months Is Too Long
Roundcube is a browser-based IMAP client. BleepingComputer describes it as the default mail interface for thousands of services with millions of users, and it comes pre-installed with the cPanel hosting control panel. Many organizations therefore run it without having chosen it, simply because it came with their hosting stack.
Its security record is well documented. BleepingComputer notes that the Russian group Winter Vivern (TA473) used a cross-site scripting zero-day, CVE-2023-5631, against European government bodies, and that APT28 exploited CVE-2020-35730, CVE-2020-12641 and CVE-2021-44026 to break into Ukrainian government email systems. In February 2026, CISA listed two more Roundcube bugs, CVE-2025-49113 and CVE-2025-68461, as actively exploited and gave U.S. federal agencies three weeks to fix them. BleepingComputer counts 11 Roundcube vulnerabilities that CISA has tagged as exploited since May 2022.
That history shows why attackers keep coming back to Roundcube. It does not tell us who is exploiting CVE-2026-48842. No public source connects the current attacks to Winter Vivern, APT28 or any other named group.
Exposure is also hard to pin down. BleepingComputer reports that Shadowserver tracks more than 523,000 Roundcube instances visible on the internet. That counts reachable installations. It does not show how many run a vulnerable version, how many have virtuser_query enabled, or how many are honeypots. The number of servers that can actually be exploited is almost certainly much smaller. Nobody knows how much smaller, and an administrator cannot tell from outside which group their own server is in.
What this means for you
Anyone who runs Roundcube should confirm the version and plugin status of every instance this week. Internet-facing servers with virtuser_query enabled come first. Windows-centric shops can have Roundcube too, on a Linux mail relay, a hosted cPanel account or a service run by a managed provider. GBHackers recommends that administrators identify all Roundcube Webmail instances, including hosted, managed-service, and third-party deployments. For hosted mail, the job is to get written confirmation from the provider that it has patched. If you have no Roundcube anywhere, nothing needs doing.
If you cannot upgrade straight away, disable or remove the plugin. The OpenCVE summary advises that if an upgrade is not immediately possible, disable or remove the virtuser_query plugin from the system to eliminate the attack vector. Check first whether your login flow depends on it. Its job is mapping addresses to mailboxes, so turning it off could stop some users logging in on setups that rely on those lookups. No public source spells out the exact service impact, so test before switching it off in production. OpenCVE also suggests restricting the Roundcube database account to the minimum privileges required. That helps whatever else you do.
There are no CVE-specific detection signatures yet. For servers that were exposed, CyberSecurityNews recommends checking web-server, application, database, and authentication logs for unusual requests, failed database queries, unexpected error messages, or suspicious activity involving Roundcube endpoints. GBHackers also suggests restricting public access to vulnerable Roundcube services until remediation is complete, for example by putting webmail behind a VPN or an IP allowlist for as long as patching takes.
- Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 are vulnerable to CVE-2026-48842, but only when the
virtuser_queryplugin is enabled. - Upgrade to the newest release on your branch (1.6.19 or 1.7.4 as of September 6), not just the May minimums, so the later security fixes are included too.
- On Debian, cPanel or other packaged installs, check the vendor's package version or advisory, because backported fixes do not always change the upstream version number.
- If you cannot patch immediately, disable or remove
virtuser_queryafter confirming your logins do not depend on it, and restrict the Roundcube database account's privileges. - Review web, application, database and authentication logs on any internet-facing instance that ran a vulnerable version with the plugin enabled.
- Do not treat Shadowserver's figure of more than 523,000 exposed instances as a victim count, and do not blame the attacks on any named group based on Roundcube's history.
The fix for CVE-2026-48842 has been available since May, and the Cyber Centre's September 21 update tells laggards they are out of time. The main risk now falls on the Roundcube installs nobody is actively watching, such as those bundled with cPanel or run on old relays and third-party hosting. Past exploited Roundcube flaws ended up in CISA's catalog with federal deadlines attached, and a KEV listing for this one would put a formal date on it. Administrators do not need to wait for that listing before upgrading.