In short: Roundcube webmail has a critical vulnerability, CVE-2026-48842 (CVSS 8.1) — a SQL injection that fires BEFORE login, with no password and no user interaction required. Monitoring group Shadowserver counts over 523,000 Roundcube instances exposed online, and Canada's Centre for Cyber Security confirmed on September 21, 2026 that the flaw is being actively exploited. A patch has existed since May, but far from everyone has installed it.
What happened
Roundcube is one of the world's most widely deployed webmail interfaces, used by hosting providers, corporate mail servers, and ISPs as a lightweight alternative to full desktop mail clients. CVE-2026-48842 lives in the built-in virtuser_query plugin, which looks up users in a database by email address. A backslash-escaping bug in the preg_replace() function lets an attacker bypass that safeguard and inject arbitrary SQL — and anyone can do it, with no account and no click required from the victim.
Affected versions are Roundcube Webmail before 1.6.16 (LTS branch) and before 1.7.1 (current branch). Developers closed the hole on May 24, 2026, but as often happens with self-hosted software, a large share of administrators never applied the update.
Already under attack
Canada's Centre for Cyber Security updated advisory AV26-503 on September 21, 2026, explicitly warning that CVE-2026-48842 is being exploited in real-world attacks. According to SecurityLab.ru, the exploit fires before authentication and requires no user action at all — a victim only needs a vulnerable, internet-facing Roundcube instance. BleepingComputer confirms that successful exploitation lets an attacker with zero privileges bypass authentication, run arbitrary database commands, and steal data straight out of it.
Why this matters beyond IT teams
Your inbox is the key to everything else: it's where you reset passwords, receive verification codes, and store correspondence. A breach of Roundcube's database can hand an attacker access to thousands of users' emails, contacts, and metadata in a single query — no password guessing, no phishing required. It's the same class of risk we covered in the F5 BIG-IP APM vulnerability: the more invisible a piece of infrastructure is to the end user, the later they find out it was breached.
How to protect yourself
If you run a mail server. Update Roundcube to 1.6.16 or 1.7.1 immediately. If you can't patch right away, disable or remove the virtuser_query plugin, since that's the specific attack vector, and check database logs for anomalous queries.
If you're an everyday user. You can't tell directly whether your email provider runs a vulnerable Roundcube version, but basic hygiene limits the damage from any breach: turn on two-factor authentication everywhere you can, never reuse your email password elsewhere, and periodically check your address on Have I Been Pwned. On untrusted networks — public Wi-Fi, someone else's router — only access webmail over an encrypted connection: LiMP VPN encrypts your traffic and keeps no connection logs. Learn more on the LiMP VPN features page.