Actively Exploited Pre-Authentication SQL Injection in Roundcube Webmail
Active Exploitation · 16 sources · Updated 1mo ago · First seen Sep 24, 2026
A critical SQL-injection flaw in Roundcube Webmail's virtuser_query plugin, tracked as CVE-2026-48842, is being actively exploited in the wild. The pre-authentication vulnerability stems from a backslash-escaping bypass in PHP's preg_replace handling and can allow an attacker to manipulate database queries before logging in, provided the vulnerable plugin is enabled and reachable.
The Canadian Centre for Cyber Security cited open-source reporting confirming exploitation and urged organizations to act immediately. Affected deployments include Roundcube versions earlier than 1.6.16 in the 1.6 LTS branch and earlier than 1.7.1 in the 1.7 branch; administrators should update exposed instances, verify whether virtuser_query is enabled, and review web, application, database, and authentication logs for compromise indicators.
