Skip to content
TrustList
News

Roundcube webmail flaw fixed in May is now being exploited

Editorial

By TrustList Editorial

Attackers are using CVE-2026-48842, a pre-login SQL injection in Roundcube's virtuser_query plugin, four months after the fix. Anyone running Roundcube, or buying mail from a host that does, should check for 1.6.19 or 1.7.4.

About Roundcube webmail flaw fixed in May is now being exploited

Roundcube webmail flaw fixed in May is now being exploited

24 September 2026 — A flaw in Roundcube, the open-source webmail software used by many hosting companies and by organisations that run their own mail, is being exploited. The Canadian Centre for Cyber Security updated its advisory AV26-503 on 21 September 2026 to say that CVE-2026-48842 "is being exploited in the wild". BleepingComputer reported the warning on 24 September and dated it to 22 September; the advisory page itself shows 21 September.

What the flaw does

CVE-2026-48842 is an SQL injection in Roundcube's built-in virtuser_query plugin that works before anyone logs in. An attacker can get past authentication and read data from Roundcube's database without any action by a user. The Shadowserver Foundation tracks about 523,000 Roundcube installations reachable from the internet, according to BleepingComputer, although only those using the affected plugin are exposed.

Roundcube fixed the flaw in versions 1.6.16 and 1.7.1 on 24 May 2026. Three further security releases have followed, and the newest, 1.6.19 and 1.7.4, came out on 6 September. The flaw was not on CISA's exploited list as of its 24 September catalogue.

Who is affected

Any organisation that runs Roundcube below 1.6.16 or 1.7.1 with virtuser_query configured. It also reaches businesses that never installed Roundcube themselves: many web hosts and control panels offer it as their webmail, so the version in use is the host's decision.

What to do

  • If you run Roundcube, upgrade to 1.6.19 or 1.7.4 rather than stopping at the minimum fixed version, because the later releases fix further flaws.
  • Check whether virtuser_query is configured. If you cannot upgrade straight away, disable or remove it.
  • If your hosting or mail provider offers Roundcube, ask which version it runs and when it was last updated.
  • Look for unexpected logins or database reads since late May, and treat any stored mail credentials as at risk if you find them.

Sources

Keep exploring

More on TrustList

Everything here links back to the same verified catalogue. Pick your next stop.