Roundcube webmail flaw fixed in May is now being exploited

Roundcube webmail flaw fixed in May is now being exploited

24 September 2026: A flaw in Roundcube, the open-source webmail software used by many hosting companies and by organisations that run their own mail, is being exploited. The Canadian Centre for Cyber Security updated its advisory AV26-503 on 21 September 2026 to say that CVE-2026-48842 "is being exploited in the wild". BleepingComputer reported the warning on 24 September and dated it to 22 September; the advisory page itself shows 21 September.

What the flaw does

CVE-2026-48842 is an SQL injection in Roundcube's built-in virtuser_query plugin that works before anyone logs in. An attacker can get past authentication and read data from Roundcube's database without any action by a user. The Shadowserver Foundation tracks about 523,000 Roundcube installations reachable from the internet, according to BleepingComputer, although only those using the affected plugin are exposed.

Roundcube fixed the flaw in versions 1.6.16 and 1.7.1 on 24 May 2026. Three further security releases have followed, and the newest, 1.6.19 and 1.7.4, came out on 6 September. The flaw was not on CISA's exploited list as of its 24 September catalogue.

Who is affected

Any organisation that runs Roundcube below 1.6.16 or 1.7.1 with virtuser_query configured. It also reaches businesses that never installed Roundcube themselves: many web hosts and control panels offer it as their webmail, so the version in use is the host's decision.

What to do

• If you run Roundcube, upgrade to 1.6.19 or 1.7.4 rather than stopping at the minimum fixed version, because the later releases fix further flaws.
• Check whether virtuser_query is configured. If you cannot upgrade straight away, disable or remove it.
• If your hosting or mail provider offers Roundcube, ask which version it runs and when it was last updated.
• Look for unexpected logins or database reads since late May, and treat any stored mail credentials as at risk if you find them.

Related on TrustList:

• PingCAP breach: TiDB Cloud users told to replace API keys now
• psqlODBC 18.00.0006 fixes two more memory corruption flaws
• DuckDB 1.4 support ends 17 November as 2.0 LTS ships

Sources

• Canadian Centre for Cyber Security: Roundcube security advisory (AV26-503), updated 21 September 2026 - 21 September 2026
• Roundcube news: security updates (read 25 September 2026) - 25 September 2026
• BleepingComputer: Hackers now exploit critical Roundcube flaw in code injection attacks - 24 September 2026