Roundcube SQL Injection Vulnerability Reportedly Exploited in the Wild
Summary
Canada’s cybersecurity centre reported active exploitation of CVE-2026-48842, a pre-authentication SQL injection flaw in Roundcube’s optional virtuser_query plugin. Versions before 1.6.16 or 1.7.1 are affected; updating or disabling the plugin mitigates exposure.
Key points
- The Canadian Centre for Cyber Security reported active exploitation in an update to advisory AV26-503 on September 21.
- CVE-2026-48842 is a high-severity SQL injection flaw with a CVSS v3.1 score of 8.1.
- The flaw affects Roundcube versions earlier than 1.6.16 or 1.7.1 when the optional virtuser_query plugin is enabled.
- Exploitation occurs before authentication and may expose information accessible through the affected database queries; impact depends on deployment and database permissions.
- The article says public reporting has not detailed observed post-exploitation activity or threat-actor objectives.
- Upgrade to fixed version 1.6.16 or 1.7.1; disabling the plugin may reduce risk temporarily if the deployment does not require it.
- Review web server, Roundcube, authentication, and database logs for unusual requests or errors, especially on internet-facing deployments.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- High (CVSS v3.1: 8.1)
- Affected Versions
- Roundcube Webmail versions earlier than 1.6.16 or 1.7.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable the virtuser_query plugin if it is not required.