Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Canada's Centre for Cyber Security has warned that attackers are actively exploiting a high-severity flaw in Roundcube, the widely used open-source webmail client. The bug, CVE-2026-48842 (CVSS 8.1), is an unauthenticated SQL injection in the virtuser_query plugin, which normally sanitizes input using backslash escaping via preg_replace() but can be tricked with specially crafted backslash sequences to inject malicious SQL queries. Researchers note that successful exploitation could let attackers manipulate database queries, steal sensitive data, access mailboxes and address books, and map out authentication and admin functionality. Roundcube patched the issue in versions 1.6.16 and 1.7.1 released in late May, though the Cyber Centre has not disclosed specifics of the observed attacks; with over 500,000 Roundcube instances reachable online, administrators are urged to update promptly.