Attackers are actively exploiting a SQL injection vulnerability in Roundcube Webmail. CVE-2026-48842, rated high severity, has been known since late May and is patched in current releases. Administrators who have not yet updated are at risk of attackers manipulating or deleting database contents.
The Vulnerability
The flaw sits in the virtuser_query plugin, which handles database queries in Roundcube. When the plugin is active, unauthenticated remote attackers can exploit the SQL injection without any credentials. Canada's Centre for Cyber Security has issued an advisory warning of ongoing attacks. Instances that have virtuser_query disabled are not affected.
The vulnerability was fixed in versions 1.6.16 and 1.7.1, released in spring. Current versions are 1.6.19 and 1.7.4. Shadowserver researchers count more than 520,000 publicly reachable Roundcube instances worldwide, around 16,000 of them in Germany. How many are still running a vulnerable version is unknown. The developers have not yet released indicators of compromise for detecting already-attacked instances.
What to Do
Update Roundcube Webmail to 1.6.19 or 1.7.4 as soon as possible. If an immediate update is not feasible, disable the virtuser_query plugin as a temporary mitigation. Roundcube is a recurring target for attackers, most recently in February this year. Prompt patching is therefore especially important.