A High-Severity Vulnerability in Roundcube Webmail Client is Being Exploited by Attackers
Threat actors have been exploiting a critical vulnerability in Roundcube, a widely used open-source webmail client, according to warnings from the Canadian Centre for Cyber Security. The vulnerability, tracked as CVE-2026-48842, allows attackers to inject malicious SQL code into databases without needing to authenticate, potentially granting them access to sensitive information and user data.
The issue lies in the virtuser_query plugin, which resolves email addresses to mailbox usernames and uses a filter to prevent injection attempts. However, attackers have found a way to bypass this protection by using crafted queries that exploit a flaw in the regular-expression escaping mechanism. This allows them to concatenate quote characters into an SQL string sent to the database, enabling them to tamper with database operations and access protected information.
The vulnerability was patched in Roundcube versions 1.6.16 and 1.7.1, released in late May. Despite this, threat actors have been exploiting it in attacks, according to the Canadian Centre for Cyber Security. The scope of the issue is unclear, but data from the non-profit organization The Shadowserver Foundation shows that there are over 500,000 Roundcube servers accessible from the internet.
Successful exploitation of the bug allows attackers to access user identities, messages, and address books, as well as map authentication workflows and admin functions. This could have significant consequences for organizations using Roundcube webmail client, potentially leading to data breaches and compromised systems.
It’s worth noting that vulnerabilities in Roundcube servers are frequently targeted by threat actors. For instance, CVE-2025-68461, CVE-2025-49113, and CVE-2024-37383 were all exploited in the past. This highlights the importance of keeping software up-to-date and implementing robust security measures to prevent exploitation.
To mitigate this risk, organizations using Roundcube webmail client should ensure they are running patched versions of the software. Regularly updating systems and implementing robust access controls can also help to prevent exploitation. Additionally, monitoring for suspicious activity and conducting regular vulnerability assessments can help identify potential issues before they become major problems.
Source: SecurityWeek — 2026-09-25