Roundcube Webmail SQL Injection Exploited Through virtuser_query Plugin

Exploitation attempts have been reported against CVE-2026-48842, a high-severity, pre-authentication SQL injection vulnerability in Roundcube Webmail’s virtuser_query plugin. The flaw has a reported CVSS score of 8.1 and affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Regular-expression replacement processing allows a backslash escape bypass that undermines previously applied SQL escaping. Greenbone reported that Coalition observed exploitation attempts against a honeypot and that the Canadian Centre for Cyber Security issued an exploitation warning on September 21; these reports do not establish successful compromises of production systems.

Roundcube’s fix replaces regular-expression replacement with literal placeholder substitution. Defenders should prioritize upgrading affected installations to the latest fixed release in their supported branch, verify whether the virtuser_query plugin is enabled, and review exposure to vulnerabilities disclosed after the initial fix. Coalition’s listing identifies GitHub repositories labeled as proof-of-concept or exploit material, but reports no ExploitDB or Metasploit exploits and does not independently confirm active exploitation. Greenbone stated that the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog at publication; that absence should not delay remediation given the reported attack attempts.