Roundcube's four-month-old patch is now being exploited
Canada's cyber centre says CVE-2026-48842, a pre-authentication SQL injection fixed in May, is being exploited in the wild while more than half a million Roundcube installations sit exposed.
A SQL injection flaw in Roundcube Webmail was fixed on 24 May. Four months later it is being used against live servers: on Monday 21 September, the Canadian Centre for Cyber Security updated its May advisory to warn that CVE-2026-48842 is being exploited in the wild. The bug sits in virtuser_query, a plugin that ships as part of the webmail package, and it asks nothing of its victim — no credentials to steal, no link to click. Anyone who can reach a Roundcube login page can bypass authentication and run commands against the mail database behind it.
What's actually going on
Roundcube's own release notes for the 24 May security update describe the flaw as a “pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass”, credited to a researcher going by skull, and fixed in versions 1.6.16 and 1.7.1. The project's advice at the time was blunt: it “strongly recommend[ed]” updating every production 1.6.x and 1.7.x installation. What changed this week is not the bug but the evidence. “Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild,” the Canadian advisory now says.
The scale is the awkward part. Roundcube is the browser-based IMAP client sitting in front of a very large number of mailboxes, and it is pre-installed with cPanel, the hosting panel that runs a sizeable share of the shared-hosting web. Shadowserver, which scans the internet for exposed services, counts over 523,000 Roundcube instances it can see — with the honest caveat that it cannot say how many are honeypots or have already been patched. Where an upgrade cannot happen today, the workaround is to disable or remove the virtuser_query plugin, which takes the attack surface with it.
Why you should care
Roundcube has been a target before. The Russian group tracked as Winter Vivern, also known as TA473, used a cross-site scripting zero-day (CVE-2023-5631) against its users, and APT28 has chained a run of older flaws in the same software (CVE-2020-35730, CVE-2020-12641, CVE-2021-44026) for espionage. In February, the US Cybersecurity and Infrastructure Security Agency added two more Roundcube bugs (CVE-2025-49113 and CVE-2025-68461) to its Known Exploited Vulnerabilities catalogue and gave federal agencies three weeks to fix them. Webmail earns that attention because of what lands in it: password resets, invoices, contracts, the calendar invite that tells an attacker when the office is empty. If those mailboxes sit on a European server, the operator may also owe patching duties under NIS2 — and a fix that has been available since May does not count as handled.
Our opinion
The number worth staring at is not 523,000. It is four months. A patch that exists and a patch that is installed are two completely different objects, and the distance between them is the business model of every ransomware crew currently employed. What makes Roundcube's case sharper than the usual lag is how the software gets there in the first place: bundled by a hosting panel, maintained by somebody the mailbox owner has never spoken to, on a server they have never logged into. “Disable the virtuser_query plugin” is only useful advice to the person who knows the plugin is switched on, and that is the hosting provider — not the dentist whose appointment confirmations live in the inbox.
Nothing about this exploit is exotic, either. There is no zero-click chain, no browser renderer bug, no state-level magic in the technique: an input reached a database call without being handled properly, which is the same category of mistake that has shipped in software for twenty years. That it is being exploited in the wild a full four months after a tested fix was published says very little about CVE-2026-48842 and quite a lot about the thousands of machines that nobody is looking at.