Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Canada's Cyber Centre has confirmed real-world exploitation of a fixed Roundcube Webmail flaw, CVE-2026-48842 (CVSS 8.1), which lets unauthenticated attackers run arbitrary SQL commands through the virtuser_query plugin due to a flawed backslash-escaping check in preg_replace(). The bug affects Roundcube 1.6.x releases prior to 1.6.16 and 1.7.x releases before 1.7.1, and could let intruders pull mail credentials and stored messages straight from the database. Roundcube shipped fixes back in May 2026, yet Shadowserver still counts over 523,000 internet-facing instances, with a handful already flagged as vulnerable in late September. Roundcube remains a recurring target — Proofpoint previously linked the China-aligned group UNK_MassTraction to abuse of earlier Roundcube bugs for deploying web shells and the VShell tool, while CISA flagged two separate Roundcube CVEs as actively exploited earlier this year.