Roundcube Webmail Vulnerability in Attackers’ Crosshairs

1. Executive summary

CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The Canadian Centre for Cyber Security says the flaw is being exploited in the wild, and Roundcube fixed it in 1.6.16 and 1.7.1, released in late May 2026. NVD scores it CVSS 8.1 HIGH; it is not in CISA KEV and EPSS sits at 1%. Shadowserver counts more than 500,000 internet-accessible Roundcube servers, so any EMEA financial firm running an unpatched instance, particularly one exposed to the internet, should treat this as an active exploitation risk rather than a theoretical one.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	A pre-authentication SQL injection in an internet-facing mail component is under active exploitation, so an intrusion may already be present without a patch event to trigger detection.	Incident management must cover detection of exploitation of an already-patched flaw, not only response to a disclosed CVE.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If exploitation of CVE-2026-48842 meets the major-incident threshold, the reporting clock starts from classification, not from patch deployment.	Confirm whether a Roundcube compromise is a reportable major incident and preserve the timeline evidence needed to classify it.
NIS2 Art. 21(2)(d): supply chain security measures	Roundcube is third-party open source software embedded in the mail path, and the fix depends on the upstream 1.6.16 / 1.7.1 releases.	Supply chain measures must cover tracking and applying upstream fixes for open source components in the mail stack.

3. Technical analysis & attack chain

CVE-2026-48842 is an SQL injection in the virtuser_query plugin of Roundcube Webmail. The plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralise injection attempts. The flaw lets an attacker bypass that protection with crafted queries containing backslash sequences that defeat the plugin’s regular-expression escaping mechanism. The malicious input invokes the virtuser_query plugin to traverse the preg_replace() filter, and quote characters are then concatenated into an SQL string that is sent to the database. The injection is reachable without authentication.

Confirmed attack chain:

The attacker sends crafted input containing backslash sequences to a Roundcube instance running an affected version (1.6.x before 1.6.16, or 1.7.x before 1.7.1) with the virtuser_query plugin in use.
The backslash sequences defeat the preg_replace() escaping in the plugin.
Quote characters from the attacker’s input are concatenated into an SQL string.
That string is sent to the backend database, giving the attacker SQL injection without authentication.

Observed impact, per the reporting: successful exploitation allows an attacker to tamper with database operations, access protected information, access user identities, messages and address books, and map authentication workflows and admin functions. The Canadian Centre for Cyber Security did not share details of the observed exploitation, so there is no public account of post-exploitation activity, persistence, command-and-control or lateral movement for this specific campaign.

Two caveats. First, the exploitation claim rests on the Canadian Centre for Cyber Security’s statement that open-source reporting indicates CVE-2026-48842 is being exploited in the wild; no victim, sector or tooling detail was published, so the exploitation is confirmed as a warning but not corroborated with technical evidence in these sources. Second, the mechanism description (preg_replace() backslash bypass, quote concatenation) is attributed to SentinelOne via SecurityWeek and is single-sourced; treat the precise bypass construction as vendor analysis rather than independently reproduced fact.

The related ANSSI and BSI advisories in the corpus describe other Roundcube vulnerability sets (remote code execution, SSRF, XSS, privilege escalation, security-policy bypass) across separate 2026 advisories. Those describe different flaws and should not be read as additional detail on CVE-2026-48842.

4. Mitigation & containment

P1 (within 24 hours)

Identify every Roundcube instance in the estate and confirm its version. Anything in 1.6.x below 1.6.16 or 1.7.x below 1.7.1 is affected.
Upgrade affected instances to 1.6.16 or 1.7.1, the versions Roundcube released in late May 2026 that resolve CVE-2026-48842.
Where an instance cannot be upgraded immediately, remove it from direct internet exposure and restrict access to known client networks.
Check whether the virtuser_query plugin is enabled. If it is not in use, the injection path described here is not reachable, but upgrade anyway because the fix is available.

P2 (within 72 hours)

Review database and web server logs on affected instances for anomalous SQL activity and for requests carrying backslash sequences against the virtuser_query path.
Review mail account access logs for the impact set named in reporting: user identities, messages, address books, and authentication or admin workflow enumeration.
Rotate database credentials used by Roundcube if there is any sign of successful injection.

P3 (within 7 days)

Add Roundcube version tracking to the open source component inventory so upstream fixes are applied on release rather than on exploitation warning.
Confirm that any remaining internet-facing mail webmail interface has compensating controls (WAF rules for SQL metacharacters in the virtuser_query path, rate limiting, network segmentation from the mail database).

5. Indicators of compromise

No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file paths or command lines for this exploitation.

Behavioural indicators:

behaviour	where to observe	confidence
Crafted input containing backslash sequences reaching the virtuser_query plugin	Roundcube web server and application logs	Medium (mechanism single-sourced to SentinelOne via SecurityWeek)
SQL strings with concatenated quote characters sent to the mail database	Database query logs	Medium (same single source)
Enumeration of authentication workflows and admin functions	Roundcube access and admin logs	Low (impact described by a third party quoted in reporting, not observed)

6. Detection

Insufficient indicators to author detection rules. The sources provide no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values for CVE-2026-48842. The only technical artefact named is the preg_replace() filter and the virtuser_query plugin, which are legitimate Roundcube components and not threat artefacts.

CVE assessment

1 referenced CVE

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-48842	8.1 High	—	1%	Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin…

7. Sources

SecurityWeek, Roundcube Webmail Vulnerability in Attackers’ Crosshairs, https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/, 2026-09-25
The Hacker News, Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild, https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html
ANSSI France CERT, Multiples vulnérabilités dans Roundcube, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0987/, 2026-08-10
ANSSI France CERT, Multiples vulnérabilités dans Roundcube, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0320/, 2026-03-19
ANSSI France CERT, Multiples vulnérabilités dans Roundcube Webmail, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1122/, 2026-09-07
BSI Germany, [NEU] [hoch] Roundcube Webmail: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2880
BSI Germany, [UPDATE] [mittel] Roundcube: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2854

8. Adverse Trace position

Adverse Trace assesses CVE-2026-48842 as CVSS 8.1 HIGH, not in CISA KEV, with EPSS at 1%, and treats the active-exploitation warning as credible but thin: the Canadian Centre for Cyber Security cites open-source reporting and published no exploitation detail, and the bypass mechanism is single-sourced to SentinelOne via SecurityWeek, so clients should verify exposure before assuming compromise. The client impact is concentrated in firms running internet-facing Roundcube below 1.6.16 or 1.7.1, where a pre-authentication SQL injection exposes user identities, messages and address books, and the fix has been available since late May 2026. We will track for a technical exploitation report or IOC set that would let us author detection content, and we will re-issue this advisory if the Canadian Centre for Cyber Security or a vendor publishes post-exploitation detail.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.