Roundcube released the fix on 24 May. Four months later, Canada's Cyber Centre says the vulnerable path is being exploited in the wild.

The issue, CVE-2026-48842, is a pre-authentication SQL injection in Roundcube's virtuser_query plugin. An attacker does not need an account or user interaction, but the vulnerable plugin and its database-backed lookup path must be in use.

Roundcube's May security release describes the flaw as a backslash-escape bypass in a preg_replace operation used by the virtuser_query plugin. That plugin maps virtual usernames to mailbox addresses through database queries.

Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 are affected. The fixed versions are 1.6.16 and 1.7.1, although operators should normally move to the newest supported security release rather than stopping at the first fixed build.

The vulnerability has a high-complexity attack vector. That reduces reliability compared with a simple one-request exploit, but it does not add authentication or user interaction. High complexity is not a reason to leave an internet-facing mail system vulnerable after exploitation has been reported.

The Canadian Centre for Cyber Security updated its advisory on 21 September to say open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.

The advisory does not identify an actor, victim, exploitation volume or observed payload. It also does not say that every exposed Roundcube server is vulnerable. BleepingComputer reported that Shadowserver tracks more than 523,000 internet-exposed Roundcube instances, but the number does not distinguish patched systems, honeypots or deployments that do not use the affected plugin.

BlackTree previously covered a different…