If you run Roundcube webmail, or your hosting provider does, this one needs attention today. CVE-2026-48842 is a pre-authentication SQL injection in Roundcube that an attacker can hit with no login at all, and it is under active exploitation in the wild. Roundcube shipped the fix back in May 2026. The problem is the gap between “patch exists” and “patch applied,” and on shared hosting that gap is exactly where webmail installs sit and rot.
We clean up compromised hosting environments for a living, and webmail is one of the most reliably neglected surfaces on any server. It gets installed once, exposed to the internet permanently, and then nobody touches it until something goes wrong. That is the population getting hit right now.
The flaw
The vulnerability lives in Roundcube’s virtuser_query plugin, rated CVSS 8.1. The root cause is a preg_replace() backslash-escape bypass: input that should have been neutralized slips through the escaping and reaches the SQL query intact. Because the affected path is reachable before authentication, an attacker needs no account and no credentials. Per SentinelOne’s analysis, an unauthenticated attacker can inject SQL into Roundcube’s database backend through that plugin, potentially exposing mail account credentials and stored messages.
Sit with what that exposes. Roundcube’s database holds the keys to the mailboxes it serves: account credentials and the stored contents of people’s email. On a shared hosting box, one webmail install often fronts mail for many customers, so a single successful injection is not one mailbox, it is potentially every account on that instance. Email is also the reset vector for everything else, so mailbox access is rarely the end of the story.
Affected and fixed versions
The vulnerable and patched builds are narrow, so check your version precisely:
| Branch | Affected | Fixed in |
|---|---|---|
| 1.6.x | before 1.6.16 | 1.6.16 |
| 1.7.x | before 1.7.1 | 1.7.1 |
Update to at least 1.6.16 or 1.7.1 on the branch you run. If your webmail came bundled with a hosting control panel, the panel vendor may package Roundcube separately from its own updates, so confirm the actual Roundcube version rather than assuming the panel’s latest build carries it. If you’re not sure your hosting stack is tracking these versions correctly, that’s exactly the kind of gap server management done right is supposed to catch.
Why “patched in May” does not mean you are safe
This is the part that matters. The fix has existed for months, which means the exploitation you are seeing now is entirely against installs that never applied it. The timeline is instructive:
- May 2026: Roundcube released the patches.
- July 2026: a China-aligned threat actor tracked as UNK_MassTraction was already exploiting known Roundcube vulnerabilities.
- September 2026: the Canadian Centre for Cyber Security confirmed active exploitation of this flaw in the wild, citing open-source reporting.
The scale of the exposed surface is the reason this stays profitable for attackers. Shadowserver data from September 23 counted more than 523,000 Roundcube instances reachable from the internet. That is an enormous field of targets, and webmail is precisely the kind of software that gets stood up and forgotten. State-aligned actors have specifically favored Roundcube flaws because the install base is huge, internet-facing by design, and patched slowly.
What to do
- Update now to 1.6.16 or 1.7.1, whichever matches your branch. There is no substitute for the patch.
- Check the real version. Do not trust the control panel’s version label. Confirm the Roundcube build itself, and if you manage mail for clients, check every instance, because the one forgotten install is the one that gets hit.
- Assume pre-patch compromise on any instance that sat exposed on a vulnerable version between May and now. Because the payoff is credentials and message contents, treat exposure as potential data access, not just a patching to-do. If you need that confirmed rather than assumed, that’s what our hacked website and hosting cleanup team checks for.
- Rotate mail credentials on any instance you cannot rule out. If the database was reachable, assume the account passwords and stored messages in it are burned.
- Review database and access logs for anomalous queries against the Roundcube backend and for unusual authentication activity on the mail accounts it serves.
The takeaway
CVE-2026-48842 is not a novel or exotic bug. It is a plain pre-auth SQL injection with a fix that has been available since May, being exploited in September against the half-million-plus installs that never updated. That is the whole lesson: on internet-facing infrastructure, a patch you have not applied is identical to no patch at all, and webmail is the surface most likely to be running on last year’s version. Update to 1.6.16 or 1.7.1, verify the real version, and treat any instance that was exposed as a mailbox breach until you can prove otherwise. If you’d rather have someone independently confirm your mail and hosting stack is actually patched and clean, that’s exactly what our penetration testing and secure hosting services are for.