Roundcube patched a high-severity vulnerability four months ago. Attackers are now targeting systems that still have not installed the fix.
The flaw, tracked as CVE-2026-48842, is a pre-authentication SQL injection vulnerability affecting older Roundcube versions.
Canada’s cyber security agency warned on Sept. 21 that open-source reporting shows the flaw is being exploited in the wild, turning a previously patched issue into an active risk for organizations still running vulnerable servers.
Roundcube patched the vulnerability in two releases on May 24. The newly reported exploitation is therefore less about a newly discovered flaw than what happens after fixes become public.
Once a patch is available, attackers can compare vulnerable and fixed code, work out how a flaw functions, and scan for systems that have not yet been updated.
What is the Roundcube flaw?
CVE-2026-48842 is a high-severity, pre-authentication SQL injection flaw in Roundcube’s virtuser_query plugin.
The issue stems from a backslash-escape bypass involving PHP’s preg_replace() function, allowing specially crafted input to interfere with database queries.
The vulnerability affects Roundcube versions before 1.6.16 and versions before 1.7.1.
Because the flaw is pre-authentication, an attacker does not need valid Roundcube credentials before attempting to exploit it.
Roundcube quickly resolved the issue. However, the fact that attackers are now targeting unpatched installations shows the familiar problem with security updates: releasing a fix closes the flaw only for organizations that install it.
The patch is out. So are the attackers.
According to a Monday report from the Canadian Center for Cyber Security, open-source monitoring platforms report that the flaw is now being actively exploited in the wild.
One platform, Shadowserver, currently has more than 523,000 Roundcube instances exposed on the internet, showing just how many systems are potentially within attackers’ reach, even though the figure does not confirm how many are actually unpatched.
Image: Shadowserver
While these are general warnings, the pattern is quite normal for both threat actors and organizations. Security updates often take time to reach every system, leaving some exposed long after a fix is available.
For threat actors, it can be even worse. Once a vulnerability is patched publicly, the fix can give attackers more visibility into what was wrong in the first place, allowing them to study the change, work out how the vulnerability was exploited, and target organizations that have yet to install the update.
Roundcube has faced repeated exploitation
CVE-2026-48842 is just one of several vulnerabilities Roundcube users have had to contend with over the last four years, according to BleepingComputer, which says the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tagged 11 Roundcube flaws as exploited in the wild since May 2022.
Among them was CVE-2023-5631, a zero-day XSS flaw exploited by the Winter Vivern hacking group against European government targets. CVE-2023-43770 was another XSS flaw that was later added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Roundcube was also hit by CVE-2025-49113, which exposed vulnerable installations to remote code execution.
What Roundcube administrators should do now
For organizations still running an affected Roundcube version, the solution is straightforward: apply the security update. Organizations that haven’t installed it are leaving an internet-facing email system exposed to a vulnerability attackers are actively exploiting.
Security teams sometimes delay updates because a patch could break a service, disrupt a workflow, or create compatibility problems.
But there is a tradeoff: a temporary outage or broken feature can usually be fixed, while a compromised email system can expose sensitive messages, credentials, and other data, giving attackers a foothold for further attacks.
There is rarely a perfect time to patch a critical system, especially when it sits at the center of an organization’s communications. But once a vulnerability is known, fixed, and being exploited in the wild, delaying the update becomes a risk in itself.
Other news: Microsoft warns attackers are impersonating IT staff and using fake passkey and MFA update requests to trick employees into approving malicious sign-ins, allowing them to hijack sessions and access Microsoft 365 data.