A high-severity vulnerability in Roundcube, a popular open source webmail client, is being actively exploited by threat actors. The Canadian Centre for Cyber Security warns that attackers can bypass authentication to inject malicious SQL queries into the system, allowing them to access protected information, tamper with database operations, and even map admin functions.
The vulnerability, tracked as CVE-2026-48842 (CVSS score of 8.1), is an SQL injection bug in the virtuser_query plugin that resolves email addresses to mailbox usernames. Normally, this plugin uses regular-expression escaping to prevent injection attempts, but attackers have found a way around this protection by using crafted queries containing backslash sequences that defeat the escape mechanism.
When exploited, the vulnerability allows attackers to concatenate quote characters into an SQL string sent to the database. This could potentially give them access to sensitive information, such as user identities and messages, as well as administrative functions. According to Paymob’s Omar Ahmed, successful exploitation of this bug can grant attackers a foothold in the system, allowing them to conduct further malicious activities.
Fortunately, Roundcube has already released patches for versions 1.6.16 and 1.7.1 in late May, which should mitigate this vulnerability. However, it is unclear how many servers are still vulnerable, as data from The Shadowserver Foundation shows that there are over 500,000 Roundcube servers accessible from the internet.
This is not an isolated incident – vulnerabilities in Roundcube servers have been targeted by threat actors before, with several notable examples in recent years. It’s essential for organizations using Roundcube to ensure they’re running the latest versions and apply any available patches as soon as possible to prevent exploitation.
As a practical takeaway, administrators should prioritize patching their Roundcube installations immediately and verify that their systems are up-to-date. Additionally, it’s crucial to implement robust security measures, such as monitoring for suspicious activity and implementing regular backups, to minimize the impact of potential attacks.
Source: SecurityWeek — 2026-09-25