Threat actors have been exploiting a high-severity vulnerability in Roundcube, the popular open source webmail client, the Canadian Centre for Cyber Security warns.
Tracked as CVE-2026-48842 (CVSS score of 8.1), the security defect is described as an SQL injection in the virtuser_query plugin that can be exploited without authentication.
The plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.
CVE-2026-48842, however, allows attackers to bypass the protection by using crafted queries containing backslash sequences that defeat the plugin’s regular-expression escaping mechanism.
The attacker’s malicious input invokes the virtuser_query plugin to traverse the preg_replace() filter, resulting in quote characters being concatenated into an SQL string that is sent to the database, SentinelOne explains.
Roundcube resolved the vulnerability in versions 1.6.16 and 1.7.1, which were released in late May.
This week, the Canadian Centre for Cyber Security warned that threat actors have been exploiting it in attacks, but did not share details on the observed exploitation.
“Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild,” the Cyber Centre said.
As Paymob information security lead Omar Ahmed points out, successful exploitation of the bug allows attackers to tamper with database operations, access protected information, access user identities, messages, and address books, and map authentication workflows and admin functions.
Data from the non-profit organization The Shadowserver Foundation shows that there are over 500,000 Roundcube servers accessible from the internet, but it is unclear how many of them are vulnerable.
Vulnerabilities in Roundcube servers are frequently targeted by threat actors. Some examples include CVE-2025-68461, CVE-2025-49113, and CVE-2024-37383.
Related: SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
Related: Critical WordPress Vulnerability Exploited Immediately After Disclosure
Related: Adobe Patches Critical Flaws in Connect, AEM Forms
Related: Check Point Patches Exploited Management Server Zero-Day
