Organizations running Roundcube Webmail have a new reason to check their patch levels today: the Canadian Centre for Cyber Security has confirmed active exploitation of a pre-authentication SQL injection vulnerability affecting the widely used open-source email platform, and unlike many disclosed flaws, this one doesn’t require attackers to have any valid login credentials at all.

The Vulnerability, in Plain Terms

The flaw, tracked as CVE-2026-48842, sits inside Roundcube’s virtuser_query plugin and stems from how the software handles backslash escaping in a PHP function called preg_replace. Attackers can craft input that slips past that escaping logic and manipulates the underlying database query — and crucially, they can do it before a user ever logs in. That “pre-auth” characteristic is what makes this bug particularly dangerous: there’s no password to guess or steal first, just a vulnerable, internet-reachable Roundcube instance to find.

From Disclosure to Active Abuse

The vulnerability isn’t brand new — it was originally disclosed through security advisories back on May 24, 2026. What’s changed is the threat picture. The Canadian Centre for Cyber Security updated its advisory (AV26-503) on September 21, 2026, specifically to warn that threat actors are now actively abusing the flaw in real-world attacks, not just probing for it in research settings. That shift from theoretical risk to confirmed exploitation is exactly the kind of signal that tends to trigger a wave of opportunistic scanning, as less sophisticated attackers pile on once proof that something works becomes public knowledge.

Who’s Affected

The vulnerability affects Roundcube installations running versions prior to 1.6.16 on the long-term support branch, and versions prior to 1.7.1 on the newer release branch. Given how widely Roundcube is deployed by hosting providers, universities, and small-to-midsize organizations as a self-hosted webmail front end, the pool of potentially exposed instances is significant, and many of them may not be centrally patch-managed the way larger enterprise email platforms are.

Why Webmail Platforms Are High-Value Targets

Internet-facing webmail systems are an attractive target well beyond the inboxes they display. A successful compromise can expose:

• User identities and complete message archives, including sensitive business or personal correspondence.
• Address books that feed directly into more convincing phishing and business email compromise campaigns.
• Authentication data and session details that can enable further lateral movement.
• Administrative functions, if the compromised account or database access extends to server-level configuration.

Threat actors commonly treat a webmail breach as a foothold rather than an endpoint — a way to harvest credentials and legitimate-looking email threads that can then be weaponized in follow-on social engineering against the victim organization’s own contacts and partners.

What to Do Right Now

Roundcube has already shipped a fix: version 1.6.16 patches the SQL injection issue in the virtuser_query plugin, and the project recommends backing up data before applying it. For any organization running Roundcube, the priority list looks like this:

• Inventory every Roundcube installation across the environment and confirm the exact version in use.
• Check whether the virtuser_query plugin is enabled, since that’s the specific component affected.
• Apply the 1.6.16 (or 1.7.1) update immediately, prioritizing any instance that’s reachable from the public internet.
• Review server and application logs for suspicious query patterns or unusual mailbox access that predates patching.
• Restrict administrative access and enforce multi-factor authentication wherever the platform supports it.
• Ensure the database account Roundcube uses runs with the minimum privileges necessary, limiting the damage a successful injection could do even against an unpatched instance.
• Watch for unusual outbound traffic that might indicate data being exfiltrated from a compromised mailbox database.

With confirmed in-the-wild exploitation now on record, the window for treating this as a lower-priority patch has closed. Any organization that hasn’t already updated should treat exposed Roundcube instances as an active, ongoing risk rather than a routine maintenance item.