Critical Roundcube flaw now under active exploitation

A critical vulnerability in the Roundcube webmail client, fixed back in May, is now being actively exploited by attackers. The warning comes from the Canadian Centre for Cyber Security, which updated its earlier May advisory.

Roundcube Webmail is a browser-based IMAP client used as the default mail interface by thousands of services with millions of users. It also ships pre-installed with the widely used cPanel web hosting control panel.

The flaw

In May, the Roundcube team patched the bug, tracked as CVE-2026-48842, describing it as a pre-authenticated SQL injection in the built-in virtuser_query plugin, which handles database-driven user lookups and maps users to email addresses.

Successful exploitation lets an attacker with no privileges bypass authentication, inject and execute malicious database commands, and steal data from the database. The attack is high in complexity but requires no user interaction. Developers strongly urged administrators to upgrade to versions 1.6.16 and 1.7.1.

Scale of the threat

The threat-monitoring non-profit Shadowserver currently tracks more than 523,000 Roundcube instances exposed on the internet, though it is unclear how many are honeypots or already patched.

On Monday, four months after the fix shipped, the Canadian Centre for Cyber Security updated its May advisory, noting that open-source reporting indicates the flaw is being exploited in the wild. Admins who cannot upgrade immediately are advised to disable or remove the virtuser_query plugin to eliminate the attack vector.

Roundcube flaws have long attracted both cybercriminals and state-backed groups. The Russian Winter Vivern (TA473) group exploited an XSS zero-day (CVE-2023-5631) against European government targets, while APT28 abused several flaws to breach Ukrainian government email systems. In February, CISA flagged two other Roundcube bugs as actively exploited. Since May 2022, the agency has tagged 11 Roundcube Webmail vulnerabilities as exploited in the wild.

Source: Bleeping Computer