Do Son 
TL;DR
On May 24, 2026, Roundcube developers released important security updates to fix a critical SQL injection flaw. Meanwhile, the Canadian Centre for Cyber Security confirmed this Roundcube Webmail vulnerability is currently being exploited in the wild. Consequently, administrators must update to versions 1.6.16 or 1.7.1 immediately to secure their email infrastructure.
- CVE: CVE-2026-48842
- CVSS: 8.1 (High · CVSSv3)
- Product: Roundcube Webmail
- Affected: 1.6.0, 1.7.0
- Impact: CWE-89
- Status: Exploited in the wild
- Patched in: 1.6.16, 1.7.1
- EPSS: 0.8% (30-day)
- Action: Update to 1.6.16, 1.7.1 now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy It Matters
Millions of organizations rely on Roundcube for open-source webmail access. Thus, a pre-authentication SQL injection creates severe risks for these deployments. Additionally, the flaw carries a high CVSS base score of 8.1. An unauthenticated attacker can exploit this Roundcube Webmail vulnerability over the network. As a result, an attacker can extract sensitive email records or compromise the underlying database. Furthermore, the Canadian Centre for Cyber Security confirmed that threat actors are actively targeting this flaw. Therefore, any unpatched server presents an open door to intruders.
How The Attack Works
This security flaw exists within the virtuser_query plugin. Initially, the plugin uses a regular expression to sanitize user input. However, attackers can bypass the preg_replace backslash escape mechanism. First, an attacker submits specially crafted backslash sequences to the server. Then, the application fails to neutralize these special elements properly. Consequently, the attacker injects arbitrary SQL commands directly into the backend database. Importantly, this execution requires no prior authentication or user interaction.
Affected Versions
This exploited Roundcube Webmail vulnerability impacts two main release branches. Specifically, it affects version 1.6.x prior to 1.6.16. Additionally, it impacts version 1.7.x prior to 1.7.1. Ultimately, deployments using the vulnerable virtuser_query plugin face direct exposure.
Patch Or Mitigation Steps
Administrators must upgrade their installations without delay. Fortunately, the development team addressed the issue in Roundcube security updates 1.6.16 and 1.7.1. If patching is impossible, disable the virtuser_query plugin temporarily. Ultimately, securing your webmail server prevents unauthorized database access.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
