Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

Canada’s Cyber Centre has warned that attackers are actively exploiting a patched Roundcube Webmail vulnerability. Tracked as CVE-2026-48842, the flaw affects the virtuser_query plugin and can permit SQL injection before a user authenticates.

What the advisory confirms

Roundcube released fixes in versions 1.6.16 and 1.7.1 on May 24. The project described the issue as a security defect involving query handling, while the Canadian advisory now adds evidence of exploitation in the wild. The available notices do not disclose a detailed campaign profile, so attribution and victim counts remain unconfirmed.

The risk depends on whether the vulnerable plugin is enabled and how the database is configured. Successful injection could expose information held by the webmail backend, including data that may support further account compromise. Internet-facing email systems are especially sensitive because they combine identity, communications and recovery workflows.

Immediate defensive actions

Administrators should identify Roundcube versions and enabled plugins, upgrade to a fixed release, review web and database logs for unusual query patterns, and rotate affected credentials if compromise is suspected. Restricting unnecessary public exposure and applying least privilege to the database account can reduce impact. SectechMedia covers connected defensive controls in its cyber-physical security channel.

Sources

• Canadian Centre for Cyber Security advisory
• Roundcube security updates — May 24, 2026
• The Hacker News coverage — September 25, 2026