Roundcube’s patched SQL-injection flaw reportedly enters active exploitation

Reported exploitation of virtuser_query SQL injection

According to BleepingComputer, the Canadian Centre for Cyber Security warned that attackers are exploiting CVE-2026-48842, a pre-authentication SQL-injection vulnerability in Roundcube Webmail’s virtuser_query built-in plugin.

Successful exploitation could allow an unauthenticated attacker to run malicious database commands and obtain data from Roundcube’s database. Roundcube released versions 1.6.16 and 1.7.1 to address the flaw; the report says administrators unable to upgrade can disable or remove the affected plugin.

Roundcube patched CVE-2026-48842 in May. The available report does not establish how many exposed installations were patched or previously attacked.

The Canadian Centre for Cyber Security has reportedly updated its advisory to identify CVE-2026-48842 as actively exploited in the wild.

523,000 exposed instances are not all established as vulnerable

The reported shift from an available patch to active exploitation changes the security status for unpatched Roundcube deployments. Shadowserver tracks more than 523,000 Internet-exposed Roundcube instances, though the report does not establish how many are vulnerable, patched, or honeypots.