Full Report
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace() backslash
Analysis Summary
# Vulnerability: Pre-Authentication SQL Injection in Roundcube Webmail
## CVE Details
- **CVE ID:** CVE-2026-48842
- **CVSS Score:** 8.1 (High)
- **CWE:** CWE-89 (SQL Injection)
## Affected Systems
- **Products:** Roundcube Webmail
- **Versions:**
- 1.6.x versions prior to 1.6.16
- 1.7.x versions prior to 1.7.1
- **Configurations:** Systems utilizing the **virtuser_query** plugin.
## Vulnerability Description
This vulnerability is a pre-authentication SQL injection flaw located in the `virtuser_query` plugin. The issue arises from a `preg_replace()` backslash escape bypass. Due to improper sanitization of input, an unauthenticated attacker can bypass escaping mechanisms to inject arbitrary SQL statements into the Roundcube database backend.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by Canadian Centre for Cyber Security).
- **Complexity:** Low (Pre-authentication).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Potential exposure of mail account credentials and stored email messages).
- **Integrity:** High (Unauthorized database modification).
- **Availability:** Medium (Potential database disruption).
## Remediation
### Patches
The following versions contain the fix for this vulnerability:
- **Roundcube 1.6.16**
- **Roundcube 1.7.1**
### Workarounds
- **Disable Plugin:** If patching is not immediately possible, disable the `virtuser_query` plugin if it is not business-critical.
- **Access Control:** Restrict access to the Webmail interface to known IP ranges via firewall or web server configuration to reduce the attack surface.
## Detection
- **Indicators of Compromise:**
- Look for unexpected SQL syntax or backslash characters in web server logs, specifically targeting the `virtuser_query` functionality.
- Monitor for the presence of web shells or the post-exploitation tool "VShell," which has been associated with similar Roundcube exploits.
- **Detection methods and tools:**
- Perform a version check on all public-facing Roundcube instances.
- Review Shadowserver Foundation reports if your IP space is monitored for vulnerable hosts.
## References
- **Vendor Advisory:** hxxps://roundcube[.]net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
- **Canadian Centre for Cyber Security Alert:** hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/roundcube-security-advisory-av26-503
- **SentinelOne Vulnerability Database:** hxxps://www[.]sentinelone[.]com/vulnerability-database/cve-2026-48842/
- **Shadowserver Statistics:** hxxps://dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?vendor=roundcube