Roundcube Security Advisory Av26 503

Back www.cyber.gc.ca

Roundcube Security Advisory Av26 503

www.cyber.gc.ca • September 28, 2026

Share: View original

On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product:

Roundcube Webmail – versions prior to 1.6.16

Roundcube Webmail – versions prior to 1.7.1

Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

Roundcube Webmail 1.6.16

Roundcube Webmail 1.71

Roundcube Open Source Webmail Software

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of Roundcube SQL Injection Vulnerability CVE-2026-48842 CVE-2026-48842 is a critical pre-authentication SQL injection vulnerability in Roundcube Webmail's virtuser_query plugin, affecting versions prior to 1.6.16 and 1.7.1. The flaw allows unauthenticated attackers to inject arbitrary SQL statements, potentially compromising sensitive data such as mail account credentials and stored messages. The Canadian Centre for Cyber Security has confirmed that this vulnerability is being actively exploited in the wild, with over 523,000 Roundcube instances exposed on the internet. Patches were released on May 24, 2026, but many systems remain vulnerable. Administrators are urged to update their installations or disable the vulnerable plugin to mitigate risks. The vulnerability has a CVSS score of 8.1, indicating high severity. Open-source reports suggest ongoing exploitation, but specific details of the attacks have not been disclosed. 10 sources 73

Extracted Entities

CVEs (1)