Canada’s Centre for Cyber Security updated its Roundcube security advisory on September 21 to warn that CVE-2026-48842, a pre-authentication SQL injection flaw in the popular open-source webmail platform, is being actively exploited. The vulnerability sits in Roundcube’s virtuser_query plugin and stems from a bypass in how the code escapes backslash characters in a PHP preg_replace call, letting an attacker inject arbitrary SQL statements into the database backend before ever logging in. Roundcube fixed the flaw in versions 1.6.16 and 1.7.1, released on May 24, 2026, alongside fixes for other reported vulnerabilities, but the Cyber Centre’s update four months later confirms open-source reporting of exploitation against organizations still running older builds.
Roundcube is deployed widely by web hosts, universities and small and midsize businesses as the webmail front end for their own mail servers, which makes it a high-value target precisely because it rarely gets the patch-management attention that a flagship enterprise product does. A pre-authentication flaw is the most dangerous class of bug for exactly this kind of software: no phished credential or stolen session token is required, only a network path to a vulnerable login page. Successful exploitation exposes the mail account database, meaning stored credentials and message contents are both at risk, not just the target webmail session itself.
The four-month gap between patch availability and confirmed active exploitation is the original insight worth flagging: unlike a headline zero-day, this is a known, already-fixed bug that stayed exploitable in production for months simply because upgrades did not happen, the same unauthenticated-access pattern this desk covered in WordPress’s own pre-auth path traversal fix and the exploitation-speed gap in a workflow engine flaw under active attack. Administrators running Roundcube should confirm they are on 1.6.16 or 1.7.1 or later immediately and review authentication logs for anomalous queries predating the upgrade.
