Threat actors have exploited a high-level security flaw in Roundcube, the popular open source webmail client, the Canadian Center for Cyber Security warns.
The security flaw is tracked as CVE-2026-48842 (CVSS score of 8.1) and is described as an SQL injection virtuser_query Plugin that can be exploited without authentication.
The plugin resolves email addresses into mailbox usernames and uses the preg_replace() Filter with backslash exit to neutralize injection attempts.
However, CVE-2026-48842 allows attackers to bypass protection by using crafted queries that contain backslash sequences that bypass the regular expression plugin’s escape mechanism.
The attacker’s malicious input calls the virtuser_query plugin to traverse the preg_replace() filter, resulting in quotes being concatenated into a SQL string that is sent to the SentinelOne database explained.
Roundcube has fixed the vulnerability in several versions 1.6.16 and 1.7.1which were released at the end of May.
This week the Canadian Center for Cyber Security warned that threat actors have exploited it in attacks, but did not share details of the observed exploitation.
“Open source reports suggest that CVE-2026-48842 is being exploited in the wild,” the Cyber Center said.
As Paymob information security manager Omar Ahmed points outBy successfully exploiting the flaw, attackers can manipulate database operations, access protected information, access user identities, messages and address books, and map authentication workflows and administrative functions.
Data from the non-profit organization The Shadowserver Foundation shows that there are over 500,000 Roundcube servers accessible over the Internet, but it is unclear how many of these are vulnerable.
Vulnerabilities in Roundcube servers are often targeted by threat actors. Some examples are CVE-2025-68461, CVE-2025-49113 and CVE-2024-37383.
Related: SolarWinds fixes critical RCE bugs in Observability Self-Hosted
Related: Critical WordPress vulnerability was exploited immediately after disclosure
Related: Adobe fixes critical bugs in Connect and AEM Forms
Related: Check Point Patches Exploited Management Server Zero-Day
