Hackers now exploit critical Roundcube flaw in code injection attacks

Canada's Centre for Cyber Security has confirmed that a critical Roundcube Webmail bug, CVE-2026-48842, is now being actively abused by attackers, four months after a fix was issued. The flaw lies in the virtuser_query plugin and allows unauthenticated attackers to run SQL injection attacks, bypass login, and pull data straight from the mail server's database without any user interaction. Roundcube pushed fixes in versions 1.6.16 and 1.7.1 back in May, but with over 523,000 internet-facing instances tracked by Shadowserver, many servers likely remain unpatched. Administrators unable to update immediately are advised to disable the vulnerable plugin, especially given Roundcube's history as a favored target for groups like Winter Vivern and APT28 in espionage campaigns against government networks.