Roundcube’s Fix Predated the Attack Warning
Roundcube’s 24 May 2026 fix preceded Canada’s 21 September warning of exploitation in the wild by four months. The latter cites public reporting and names no actor, victim, volume or payload.
CVE-2026-48842 concerns unauthenticated SQL injection in optional virtuser_query database-backed mailbox lookups, rather than every installation. A backslash can bypass escaping during preg_replace; the official patch uses str_replace.
Affected branches are 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The CNA records HIGH complexity with no credentials or user action. That classification does not quantify reliability.
The dated exposure report cited over 523,000 Shadowserver-visible instances, without separating patched systems or honeypots. It did not count vulnerable plugin configurations or October exposure.
Patch, then investigate
- Identify every Roundcube deployment. Include hosting panels, managed mail platforms, legacy customer portals and disaster-recovery systems.
- Confirm the running version. Upgrade affected 1.6.x and 1.7.x branches to the newest supported release. Do not rely on package-download dates.
- Check whether
virtuser_queryis enabled. If an emergency upgrade cannot happen immediately, disabling or removing that plugin can remove this specific path, but only after confirming the operational effect. - Preserve relevant evidence. Retain web, application, authentication and database logs from the vulnerable period before normal rotation removes them.
- Review unexplained database and account activity. Look for anomalous queries, authentication bypass indicators, changed mappings, unexpected administrative behaviour and follow-on access.
- Separate patching from assurance. Installing the update closes the known path. It does not establish whether the server was touched before the fix.
Our separate hosting-email report describes a different path to root. Keep hosted mail components visible in the inventory and give their evidence review a named owner. A finished upgrade is a maintenance receipt, not proof that the earlier exposure was examined.
Sources
- Vendor bulletin: 24 May 2026; no time displayed.
- Canadian advisory: 25 May, updated 21 September 2026; times unspecified.
- Official record: current primary record checked for this revision.
- Correction commit: 24 May 2026.
- Exposure report: 24 September 2026, 09:27 displayed; timezone unlabelled.
