Active Exploitation of Roundcube SQL Injection Vulnerability CVE-2026-48842

• •CVE-2026-48842 allows unauthenticated SQL injection in Roundcube Webmail.
• •Over 523,000 Roundcube instances are exposed to potential exploitation.
• •Patches were released on May 24, 2026, but many systems remain unpatched.

CVE-2026-48842 is a critical pre-authentication SQL injection vulnerability in Roundcube Webmail's virtuser_query plugin, affecting versions prior to 1.6.16 and 1.7.1. The flaw allows unauthenticated attackers to inject arbitrary SQL statements, potentially compromising sensitive data such as mail account credentials and stored messages. The Canadian Centre for Cyber Security has confirmed that this vulnerability is being actively exploited in the wild, with over 523,000 Roundcube instances exposed on the internet. Patches were released on May 24, 2026, but many systems remain vulnerable. Administrators are urged to update their installations or disable the vulnerable plugin to mitigate risks. The vulnerability has a CVSS score of 8.1, indicating high severity. Open-source reports suggest ongoing exploitation, but specific details of the attacks have not been disclosed.