Canada's Cyber Centre flags live attacks on a pre-login Roundcube SQL injection
Canada's Cyber Centre says attackers are exploiting CVE-2026-48842, a no-login SQL injection in Roundcube's virtuser_query plugin rated 8.1. Only unpatched servers running that plugin are exposed, and Shadowserver flags 10 vulnerable hosts out of more than 523,000 online.
The Watch · Security desk
What happened
- The Canadian Centre for Cyber Security says CVE-2026-48842, a Roundcube Webmail flaw, is being exploited in the wild, and it cites open-source reporting as its basis.
- The flaw is a pre-authentication SQL injection in the virtuser_query plugin, rated CVSS 8.1, affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
- Roundcube shipped the fixes in versions 1.6.16 and 1.7.1 in May 2026, about four months before the Cyber Centre added its exploitation warning.
Why it matters
- Who has to decide decision Upgrading closes the hole but cannot undo a database read. Operators who ran virtuser_query on an older build after May now have to decide whether to reset stored mail credentials.
- What it costs cost Pulling virtuser_query as a stopgap also removes the lookup that maps users to email addresses. Sites that rely on that lookup need the upgrade to keep it working.
- What doesn't add up contradiction The Hacker News reports 10 vulnerable hosts from Shadowserver data while SecurityWeek says the vulnerable count is unclear; operators have no public measure of how many servers are open to this.
Next story · Invest · Oct 1
Thirteen of 899 AI agent requests to Canada's national archives were hack attempts, Transluce saysConfirmed5 publishers
The bug is in how virtuser_query escapes input. The plugin resolves an email address to a mailbox username and passes input through preg_replace() with backslash escaping to block injection attempts [3]. SentinelOne found that crafted backslash sequences defeat that filter, so quote characters are concatenated into the SQL string sent to the database [4]. No login is required [2]. BleepingComputer describes the attack as high-complexity, needing neither privileges nor user interaction [10].
A successful injection reaches the database behind the webmail. "Unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages," SentinelOne said [5]. According to SecurityWeek, Omar Ahmed, information security lead at Paymob, points out that exploitation also gives access to user identities and address books and lets an attacker map authentication workflows and admin functions [9].
Exposure depends on that one plugin [8]. Disabling or removing virtuser_query eliminates the attack vector, according to BleepingComputer, and that is its fallback for admins who cannot upgrade yet [20]. Shadowserver counts more than 523,000 Roundcube instances on the internet and had flagged 10 of them as vulnerable as of September 23, 2026, The Hacker News reported [14]. That is about 0.002 percent, or one host in roughly 52,000 [23]. SecurityWeek, citing the same foundation, says it is unclear how many of the exposed servers are vulnerable [15].
Roundcube is a steady target. CISA has flagged 11 Roundcube Webmail vulnerabilities as exploited since May 2022 [18]. In February 2026 it added CVE-2025-49113 and CVE-2025-68461 and gave federal agencies three weeks to secure their networks [17]. In July 2026, Proofpoint reported that a suspected China-aligned group it calls UNK_MassTraction was exploiting known Roundcube flaws to deliver web shells or the VShell post-exploitation tool [21]. The Russian group APT28 used CVE-2020-35730, CVE-2020-12641 and CVE-2021-44026 to breach Ukrainian government email. Winter Vivern (TA473) used the XSS zero-day CVE-2023-5631 against European government entities [19].
"Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," the Cyber Centre said [6]. The agency has released no further detail, so none of the reporting ties the new activity to UNK_MassTraction, APT28 or any other named group [13][24].
What to watch
- Whether CISA adds CVE-2026-48842 to its exploited-vulnerabilities catalog and what patch deadline it sets for federal agencies.
- A vendor or agency report naming who is exploiting CVE-2026-48842 and what they pull from Roundcube databases once in.
- Whether cPanel's pre-installed Roundcube turns on virtuser_query; that setting decides how much shared hosting the flaw reaches.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption30
- Hype gap+25
- Incentives
- Not scored
- Confidence60
Perspective Coverage
4 publishers- Builder
- Builder 25%
- Operator
- Operator 70%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Canadian Centre for Cyber Security warned this week that CVE-2026-48842 in Roundcube Webmail is being actively exploited in the wild, citing open-source reporting.
- [2]
The issue stems from a preg_replace() backslash escape bypass that allows attackers to inject arbitrary SQL statements without authentication.
- [3]
The virtuser_query plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.
- [4]
Per SentinelOne, crafted input containing backslash sequences traverses the preg_replace() filter, resulting in quote characters being concatenated into an SQL string that is sent to the database.
- [5]
"Unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages," SentinelOne said.
- [6]
"Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," the Cyber Centre said.
- [7]
On Monday, four months after CVE-2026-48842 was patched, the Canadian Centre for Cyber Security updated its May advisory to warn that attackers are actively exploiting it.
- [8]
CVE-2026-48842 (CVSS 8.1) is a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
- [9]
Paymob information security lead Omar Ahmed points out that successful exploitation allows attackers to tamper with database operations, access protected information, user identities, messages and address books, and map authentication workflows and admin functions.
- [10]
Successful exploitation can let threat actors with no privileges bypass authentication, inject and execute malicious database commands, and steal data from Roundcube's database in high-complexity attacks that don't require user interaction.
- [11]
virtuser_query is a built-in Roundcube plugin that handles database-driven user lookups and maps users to email addresses.
- [12]
Roundcube released patches for CVE-2026-48842 in May 2026 as part of versions 1.6.16 and 1.7.1.
- [13]
No additional details of the exploitation activity have been disclosed.
- [14]
Shadowserver Foundation data shows more than 523,000 Roundcube instances exposed to the internet, with 10 of them flagged as vulnerable hosts as of September 23, 2026.
- [15]
Shadowserver data shows over 500,000 Roundcube servers accessible from the internet, but it is unclear how many of them are vulnerable.
- [16]
There is no information on how many of the 523,000 exposed Roundcube instances are honeypots or have already been patched.
- [17]
In February 2026, CISA flagged Roundcube flaws CVE-2025-49113 and CVE-2025-68461 as actively exploited and ordered government agencies to secure their networks within three weeks.
- [18]
Since May 2022, CISA has tagged 11 Roundcube Webmail vulnerabilities as exploited in the wild.
- [19]
Russian group Winter Vivern (TA473) exploited XSS zero-day CVE-2023-5631 against European government entities, and Russian APT28 abused CVE-2020-35730, CVE-2020-12641 and CVE-2021-44026 to breach Ukrainian government email systems.
- [20]
Admins who can't immediately upgrade should disable or remove the virtuser_query plugin to eliminate the attack vector.
- [21]
In July 2026, Proofpoint said it identified a suspected China-aligned adversary dubbed UNK_MassTraction exploiting known Roundcube flaws to deliver web shells or a post-exploitation tool called VShell.
- [22]
Roundcube Webmail is used as the default mail interface by thousands of services with millions of users and is pre-installed with the cPanel web hosting control panel.
- [23]
The 10 vulnerable hosts are about 0.002 percent of the more than 523,000 exposed Roundcube instances, roughly one in 52,000.
- [24]
None of the reporting attributes CVE-2026-48842 exploitation to a named threat actor; the Cyber Centre's stated basis is open-source reporting, and Proofpoint's UNK_MassTraction finding concerned known Roundcube flaws generally.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers now exploit critical Roundcube flaw in code injection attacks
1 article · September 24, 2026
- securityaffairs.comRoundcube SQL injection CVE-2026-48842 is now being exploited in the wild
1 article · September 27, 2026
- securityweek.comRoundcube Webmail Vulnerability in Attackers’ Crosshairs
1 article · September 24, 2026
- thehackernews.comRoundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
2 articles · September 25, 2026
Topics and entities
Topics
- SQL Injection
- Actively Exploited Vulnerabilities and KEV Mandates
- Webmail security
Entities
- Shadowserver Foundation
- UNK_MassTraction
- cPanel
- Roundcube Webmail
- SentinelOne
- APT28
- Proofpoint
- CISA
- Canadian Centre for Cyber Security