Attackers are actively targeting a Roundcube webmail bug that can let them access or tamper with email-related data on vulnerable servers. The flaw, CVE-2026-48842, is a high-severity unauthenticated SQL injection in the virtuser_query plugin; Roundcube fixed it in versions 1.6.16 and 1.7.1 in late May, and Canada’s cyber agency now says it is being exploited in the wild. Researchers say successful attacks could expose messages, address books, user identities, and database contents.
Why it matters: Organizations running Roundcube should treat this as urgent because internet-exposed mail systems are common and the flaw does not require login access. Update to the fixed versions immediately and review exposed Roundcube instances for signs of database or mailbox access.
info@thehackernews.com (The Hacker News)
2026.09.25
98% relevant
This is the same underlying event: active in-the-wild exploitation of the Roundcube pre-auth SQL injection flaw CVE-2026-48842 affecting Roundcube webmail servers.
Ionut Arghire
2026.09.25
100% relevant
This article establishes a distinct tracked event: active exploitation of CVE-2026-48842 in Roundcube's virtuser_query plugin, with official warning from Canada’s cyber agency and clear patched versions.
← Back to all stories