The Canadian Centre for Cyber Security has warned that attackers are exploiting CVE-2026-48842, a high-severity SQL injection issue in Roundcube Webmail. The defect can be triggered before authentication, exposing a server before a user signs in.
The bug affects Roundcube’s virtuser_query plugin and carries a CVSS severity score of 8.1. Attackers are exploiting it in the wild, as first reported by The Hacker News.
Patched Roundcube releases are available
Roundcube has addressed the problem in versions 1.6.16 and 1.7.1. Administrators running an affected installation should move to the applicable patched release, particularly where the webmail service is reachable from the internet.
- Roundcube 1.6.x releases before 1.6.16 are affected.
- Roundcube 1.7.x releases before 1.7.1 are affected.
- The affected code sits in the virtuser_query plugin.
SQL injection flaws involve application input reaching database queries in an unsafe way. In this case, the pre-authentication condition raises the stakes because an attacker does not need a valid mailbox account to reach the vulnerable path. The sign-in endpoint itself can therefore become part of an organization’s exposed attack surface.
Pre-login exposure puts webmail systems at risk
Roundcube is webmail software, placing this issue at a common boundary between public-facing infrastructure and internal email services. Patching matters because normal account protections cannot prevent attempts against a weakness that can be reached before login. Organizations that have delayed maintenance on 1.6.x or early 1.7.x builds face a known, actively exploited security problem.
The available summaries do not identify the attackers or the organizations affected. They also do not explain the exploitation technique, what actions followed a compromise, how many confirmed incidents exist, or how long the activity has been underway.
This article was produced with AI assistance from multi-source reporting and is published under our editorial standards.
