Roundcube CVE-2026-48842 Exploited in the Wild: Affected Versions and Fixes

By AiCybr Editorial · Published September 24, 2026

Canada's Cyber Centre updated its Roundcube advisory on September 21, 2026, to say open-source reporting indicates CVE-2026-48842 is being exploited in the wild. The flaw is a pre-authentication SQL injection vulnerability in Roundcube Webmail's virtuser_query plugin. Roundcube fixed it in 1.6.16 and 1.7.1, released May 24.

The affected version boundary is straightforward: Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The vulnerability has a CVSS 3.1 base score of 8.1 (High). Administrators running an affected release should update to the fixed release for their branch or a newer supported version.

The exploitation update changes the operational priority for internet-facing deployments. Roundcube's original security release already recommended updating production installations; the September Cyber Centre update adds current evidence that attackers are targeting the vulnerability.

CVE-2026-48842 at a glance

Where the vulnerability is

Roundcube's May 24 security release describes CVE-2026-48842 as a pre-authentication SQL injection in the virtuser_query plugin caused by a preg_replace() backslash-escape bypass. The plugin can map an entered email address to a mailbox username using a configured database query.

The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. That records network reachability, high attack complexity, no required privileges and no required user interaction, with potentially high confidentiality, integrity and availability impact.

This component boundary matters for triage. The vulnerable code is associated with virtuser_query; administrators should establish whether that plugin is enabled and configured on each Roundcube deployment while still using the installed version as the primary patch decision.

Which versions need an update

Roundcube's fixed-version boundary and the CVE record identify these affected lines:

Roundcube 1.6.16 and 1.7.1 were broader security releases. The same update also fixed several other issues, including sanitizer bypasses, SSRF-related problems, a pre-authentication arbitrary-file-delete issue involving Redis/memcache session poisoning, and code evaluation in the LDAP autovalues option. Upgrading therefore closes more than the SQL injection addressed by CVE-2026-48842.

Operator remediation checklist

First, identify the deployed Roundcube version from the installation/package metadata and compare it with the fixed boundary. Package-managed deployments should also check the distribution or vendor package revision because maintainers can backport fixes without matching the upstream version string exactly.

Second, inventory whether virtuser_query is enabled and how it connects to the database. Restrict the Roundcube database account to the privileges required by the application. Least-privilege database access reduces the blast radius of database-layer vulnerabilities, although it is not a replacement for installing the fix.

Third, upgrade affected installations and verify that the web application is actually serving the new code after deployment. For containerized or immutable deployments, rebuild/redeploy the service from a fixed image or package instead of changing files only inside a running container.

Fourth, review activity from the period when the vulnerable deployment was internet-accessible. Preserve relevant web-server, reverse-proxy, authentication, Roundcube and database logs before normal retention removes them. Prioritize anomalous pre-authentication requests, unusual database errors or queries, unexpected account activity and changes inconsistent with normal administration.

Finally, rotate database credentials if investigation indicates compromise or unauthorized database access. Broader credential or session rotation should follow the evidence found during incident response rather than being used as a substitute for patching and log review.

How to verify the fix

A practical verification pass should answer four questions:

1. Is every reachable Roundcube instance on 1.6.16/1.7.1 or later, or on a vendor package with a documented backport?
2. Are old containers, staging hosts, secondary webmail endpoints and disaster-recovery instances also patched?
3. Is virtuser_query enabled anywhere, and does its database account have only necessary permissions?
4. Were vulnerable internet-facing systems reviewed for suspicious activity covering their exposure window?

Version inventory is especially important where a reverse proxy points to multiple application nodes. Updating one node while an older replica remains in rotation leaves the service partially exposed.

Exploitation evidence and its limit

The Canadian Centre for Cyber Security's September 21 update says open-source reporting indicates CVE-2026-48842 is being exploited in the wild. That is the strongest current government-facing exploitation statement located for this update. The advisory does not publish an attacker identity, campaign attribution, victim count or detailed indicators of compromise.

For defenders, the actionable facts are the reported exploitation, the exact vulnerable component and the already-available fixed releases. Those facts support immediate patch verification and retrospective log review without requiring assumptions about a specific threat actor.

Bottom line

CVE-2026-48842 has had upstream fixes since May, but the September exploitation report raises its priority for any Roundcube deployment that missed those releases. Internet-facing administrators should verify that every 1.6 deployment is at least 1.6.16 and every 1.7 deployment is at least 1.7.1, confirm the status of virtuser_query, and review previously exposed systems for suspicious activity.

Sources

• Roundcube — Security updates 1.6.16 and 1.7.1: https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
• Canadian Centre for Cyber Security — Roundcube security advisory AV26-503: https://cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503
• GitHub Advisory Database — CVE-2026-48842 / GHSA-vc2v-cxrw-6g4p: https://github.com/advisories/GHSA-vc2v-cxrw-6g4p
• Roundcube 1.6.16 release: https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
• Roundcube 1.7.1 release: https://github.com/roundcube/roundcubemail/releases/tag/1.7.1