CVE-2026-48842 is a CVSS 3.1 8.1 pre-authentication SQL injection in Roundcube Webmail, reached through the built-in virtuser_query plugin via a preg_replace() backslash-escape bypass. It was patched in 1.6.16 and 1.7.1 on 24 May 2026 and is now being actively exploited — the Canadian Centre for Cyber Security updated its advisory on 22 September 2026 to warn that open-source reporting indicates exploitation in the wild.

Roundcube is significant beyond its own install base because it is the default webmail interface pre-installed with the widely used cPanel hosting control panel.

Details

The flaw is an authentication bypass combined with arbitrary SQL execution: no privileges are needed, no user interaction is required, and successful exploitation lets an attacker inject database commands and steal data from the Roundcube database.

Mitigation

Upgrade to 1.6.16 or 1.7.1. Administrators who cannot upgrade immediately should disable or remove the virtuser_query plugin, which eliminates the attack vector entirely — this is the vendor's own guidance and is the practical option for managed hosting where the PHP application is not under direct control. Shadowserver tracks more than 523,000 Roundcube instances exposed on the internet, with no data on how many are honeypots or have already been patched, so exposure is widespread and unmeasured. This is the eleventh Roundcube Webmail flaw CISA has tagged as exploited in the wild since May 2022, which itself argues for treating the product as a standing patch-priority rather than a per-advisory decision.