> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild - URL: https://f4n6.co.uk/security-feed/roundcube-pre-auth-sql-injection-flaw-actively-exploited-in-the-wild/ - Published: 2026-09-25T16:22:04.000Z - Updated: 2026-09-25T16:22:04.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-48842 ## 1\. Executive summary CVE-2026-48842 is a pre-authentication SQL injection in the `virtuser_query` plugin of Roundcube Webmail, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1\. The Canadian Centre for Cyber Security states the flaw is being actively exploited in the wild, citing open-source reporting; the vulnerability is not in CISA KEV and EPSS sits at 1%. NVD scores it CVSS 8.1 HIGH (CWE-89). Roundcube shipped fixes in May 2026, so any EMEA financial services estate still running an unpatched 1.6.x or 1.7.x build is exposed to unauthenticated database access that can expose mail account credentials and stored messages. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | A pre-auth SQL injection in an internet-facing mail component is being actively exploited, so the ICT-related incident management process must cover detection, containment and root-cause handling for this class of event. | Confirm the incident management process names webmail compromise and that on-call runbooks cover database-level SQL injection on the mail tier. | | DORA Art. 18 | Active exploitation of a flaw that exposes mail account credentials and stored messages is a candidate for classification as an ICT-related incident. | Apply the classification criteria to any confirmed Roundcube compromise and record the outcome, including where it falls below major-incident thresholds. | | NIS2 Art. 21(2)(d) | Roundcube is a third-party mail component in the supply chain, and the exploited flaw sits in a plugin (virtuser\_query) rather than core code. | Extend supply chain security measures to plugin-level inventory and to tracking vendor advisories for the mail platform. | DORA Art. 19 and NIS2 Art. 23 are not listed here because no source states that a reporting deadline has been triggered by a confirmed incident at any named entity. If a client confirms exploitation, both become live and the reporting clock starts. ## 3\. Technical analysis & attack chain The flaw is a pre-authentication SQL injection in the `virtuser_query` plugin. The mechanism, per the source, is a `preg_replace()` backslash escape bypass: input that the plugin's escaping routine should neutralise passes through and reaches the SQL statement, letting an unauthenticated attacker inject arbitrary SQL into Roundcube's database backend. No authentication is required, so the attack surface is any internet-reachable Roundcube login endpoint with the plugin enabled. Confirmed steps: 1. The attacker reaches an internet-facing Roundcube Webmail instance running 1.6.x before 1.6.16 or 1.7.x before 1.7.1 with the `virtuser_query` plugin active. 2. The attacker sends crafted input that exploits the `preg_replace()` backslash escape bypass, without authenticating. 3. The injected SQL executes against Roundcube's database backend. 4. The source states the outcome can be exposure of mail account credentials and stored messages. The source does not describe the specific request, parameter, or SQL payload used, and does not name a post-exploitation tool, web shell, persistence mechanism, or exfiltration channel for this campaign. Those details are not available and should not be assumed. Two points of context matter for defenders. First, the exploitation warning is attributed to the Canadian Centre for Cyber Security citing open-source reporting, and no exploitation detail beyond that has been disclosed; the claim that the flaw is exploited in the wild is therefore single-sourced to that warning and should be treated as reported rather than independently corroborated. Second, Shadowserver Foundation data cited in the source records more than 523,000 Roundcube instances exposed to the internet, with 10 flagged as vulnerable hosts as of 23 September 2026\. The gap between those two numbers is not explained in the source. Roundcube has been a recurring target. In July 2026 Proofpoint reported a suspected China-aligned adversary it calls UNK\_MassTraction exploiting known Roundcube flaws to deliver web shells or a post-exploitation tool called VShell. That actor has no MITRE ATT&CK profile in our verified reference data, so the attribution is unconfirmed and we do not connect it to CVE-2026-48842\. In February 2026, CVE-2025-49113 and CVE-2025-68461 in the same product were tagged as actively exploited by CISA. Neither of those is the flaw in this advisory. Discrepancy note: the ANSSI and BSI advisories in the related sources describe other Roundcube vulnerability sets (SSRF, XSS, remote code execution, privilege escalation) from March and August 2026\. Those are separate advisories and separate CVEs, not CVE-2026-48842, and should not be merged into this item's scope. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every Roundcube Webmail instance and confirm the running version. Any 1.6.x below 1.6.16 or 1.7.x below 1.7.1 is in scope. Upgrade to 1.6.16 or 1.7.1, the versions Roundcube released in May 2026. - If an instance cannot be patched immediately, disable the `virtuser_query` plugin. The flaw is in that plugin, so removing it from the active plugin set closes the injection path. Confirm the change in the Roundcube config and restart the web tier. - Where the mail service is not required to be internet-facing, restrict access at the perimeter to known source ranges and block the login endpoint from the public internet. - Treat any instance that was unpatched and internet-facing as potentially compromised. Rotate mail account credentials and IMAP/SMTP secrets for accounts on that host, and review stored messages for signs of access. P2 (within 72 hours) - Review database logs and web server access logs for anomalous queries or requests to the Roundcube login endpoint in the period before patching. The source does not provide a signature, so review is behavioural rather than signature-based. - Check for unexpected database users, scheduled jobs, or content changes in the Roundcube database that would indicate injected SQL ran. - Confirm that plugin inventory is tracked for the mail platform, not just the core application, since this flaw sits in a plugin. P3 (within 7 days) - Add Roundcube version and plugin state to the asset register and to the patch-tracking process. - Review whether the mail platform's third-party components are covered by the supply chain security measures referenced in §2. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source provides no hashes, domains, IP addresses, file paths, or command lines for this exploitation activity. It states only that the flaw is being exploited, without disclosing the activity. There are no atomic indicators to publish and no copyable block is included. Behavioural indicators: | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------- | | Unauthenticated requests reaching the Roundcube login endpoint that result in database queries against the Roundcube backend | Web server access logs, database query logs | Low; inferred from the vulnerability mechanism, not from a named campaign | | SQL injection patterns in requests to the Roundcube login endpoint | Web application firewall logs, reverse proxy logs | Low; no payload detail is given in the source | | Access to mail account credentials or stored messages without a corresponding authenticated session | Roundcube application logs, IMAP authentication logs | Low; the source states exposure is possible but gives no observed pattern | These behaviours are derived from the described mechanism, not from observed campaign telemetry. They are single-sourced to the vulnerability description and should be treated as hypotheses to test, not as confirmed detection content. ## 6\. Detection Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, or hard-coded values for this exploitation activity. The only named artefacts are the CVE identifier, the product name, and the plugin name, none of which are artefacts of the threat itself. A rule built on those would detect reporting about the flaw, not the exploitation. No YARA or Sigma rule is emitted. ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-48842](https://nvd.nist.gov/vuln/detail/CVE-2026-48842?ref=f4n6.co.uk) | 8.1 High | — | 1% | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser\_query plugin… | ## 7\. Sources - The Hacker News, "Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild", https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html, 2026-09-25 - SecurityWeek, "Roundcube Webmail Vulnerability in Attackers' Crosshairs", https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/ - ANSSI France CERT, "Multiples vulnérabilités dans Roundcube", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0320/, 2026-03-19 - ANSSI France CERT, "Multiples vulnérabilités dans Roundcube", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0987/, 2026-08-10 - BSI Germany, "Roundcube Webmail: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2880 ## 8\. Adverse Trace position We assess CVE-2026-48842 as CVSS 8.1 HIGH (CWE-89), not in CISA KEV, with EPSS at 1%. The exploitation claim rests on a single source, the Canadian Centre for Cyber Security warning citing open-source reporting, and no exploitation detail has been published; we treat it as reported and unconfirmed rather than as corroborated campaign activity. The practical risk to EMEA financial services is concentrated in estates that run internet-facing Roundcube Webmail on 1.6.x below 1.6.16 or 1.7.x below 1.7.1 with the `virtuser_query` plugin enabled, where an unauthenticated attacker can reach the database backend and potentially expose mail credentials and stored messages. We will track for published exploitation detail, a CISA KEV addition, or a vendor follow-up, and will issue an update if any of those appear. Clients who confirm exploitation on a Roundcube host should treat it as an ICT-related incident and apply the classification and reporting steps in §2. --- [Read the original source →](https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*