Threat actors are exploiting a high-severity Roundcube webmail vulnerability, according to an alert from Canada’s Cyber Centre reported by SecurityWeek. The flaw, CVE-2026-48842, is an unauthenticated SQL injection in the virtuser_query plugin and carries a CVSS score of 8.1.
The issue involves escaping intended to prevent injection attempts. SecurityWeek reports that crafted backslash sequences can bypass the plugin’s regular-expression escaping, resulting in attacker-controlled input being concatenated into a SQL string sent to the database.
Roundcube fixed the vulnerability in versions 1.6.16 and 1.7.1, released in late May. The Canadian Cyber Centre said open-source reporting indicates exploitation in the wild, but did not publish details about observed incidents. SecurityWeek notes that internet exposure is substantial, while the number of vulnerable systems remains unclear.
Administrators should identify Roundcube installations and plugins, confirm that patched versions are deployed, and examine web, database and authentication logs for anomalous queries or access patterns. As with any report of active exploitation, exposed systems that cannot be remediated promptly deserve compensating controls and careful monitoring.
Source: SecurityWeek, “Roundcube Webmail Vulnerability in Attackers’ Crosshairs”.