CVE-2026-48842: Unauthenticated SQL Injection Flaw in Roundcube Webmail Now Targeted
Overview of CVE-2026-48842, the unauthenticated SQL injection flaw in Roundcube Webmail, shown with its CVSS severity band and EPSS exploitation-probability score
CVE-2026-48842 (CVSS 8.1, EPSS ≥ 54th pctl), published in May 2026, is an unauthenticated SQL injection flaw in Roundcube Webmail. Vulnerable instances warrant prompt attention due to the elevated risk signals. The flaw affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
Coalition has reported exploitation attempts against its honeypot, and on September 21st, the Canadian Centre for Cyber Security issued an update warning of the exploited status. However, CVE-2026-48842 has not been added to CISA’s Known Exploited Vulnerabilities (KEV) list.
Roundcube Webmail has a long record of in-the-wild exploitation, particularly in espionage-motivated attacks. CISA’s KEV catalog contains 11 Roundcube vulnerabilities. Previous attack campaigns have exploited SQL injection, Cross-Site Scripting (XSS) and other types of defects in Roundcube to steal credentials and sensitive email content, and establish persistent access to the victim’s servers.
Start Your Free Trial
After CVE-2026-48842 was released in May 2026, Greenbone’s OPENVAS ENTERPRISE FEED added package detection across multiple Linux distributions [1][2][3][4][5][6][7], as well as remote banner detection for CVE-2026-48842 in Windows [8] and Linux [9] instances of Roundcube Webmail. The ENTERPRISE FEED includes regular detection for vulnerabilities affecting Roundcube Webmail, including more recent critical-severity flaws. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
Risk Assessment of CVE-2026-48842 in Roundcube Webmail
CVSS 8.1 · HighEPSS 0.8% (54th)Actively exploited
Roundcube is a PHP-based web application and server that connects to separate IMAP and SMTP mail services. The multilingual user interface is used to access and manage email messages, while the server contains sensitive credentials to an organization’s email system. CVE-2026-48842 is a network-reachable vulnerability, and no credentials or privileges are required for exploitation.
CVE-2026-48842 also warrants prompt attention due to additional elevated risk signals. Coalition has reported exploitation attempts against its honeypot. However, the flaw has not been added to CISA’s Known Exploited Vulnerabilities (KEV) list. Roundcube also has a long record of in-the-wild exploitation, particularly for cyber espionage. Recent Roundcube exploitation campaigns have targeted Ukrainian government organizations [1][2], government and military entities across Eastern Europe, including Albania, Greece, Moldova, and Türkiye [3], European government entities and think tanks [4], and physics and engineering departments at U.S. and Canadian universities [5].
A Technical Assessment of CVE-2026-48842 in Roundcube Webmail
From a technical standpoint, CVE-2026-48842 (CVSS 8.1, EPSS ≥ 54th pctl) is an unauthenticated SQL injection flaw [CWE-89] in the virtuser_query plugin. The root cause is a bypass of backslash character escaping when user-supplied input is processed by the preg_replace() function. Analyzing the fixed GitHub commits [1][2] reveals that the vulnerability is not a general failure to SQL-escape input fields. After sanitizing user-supplied credentials via $dbh->escape(), inputs were subsequently passed to PHP’s preg_replace() function.
$dbh->escape() inserted backslashes to protect SQL metacharacters. However, backslashes have a different contextual impact in the subsequent preg_replace() function, allowing an attacker to bypass the applied SQL statement protections. The fixed code now performs a literal placeholder substitution via the PHP str_replace() function.
Affected Versions and Mitigation
CVE-2026-48842 affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Although the vendor has released security updates for the affected release lines [1][2], users should review recent vulnerability scans of their Roundcube Webmail infrastructure since new critical and high-severity CVEs, such as CVE-2026-75003, have emerged since the patches for CVE-2026-48842 were released. Due to the product’s history of exploitation in the wild, users should upgrade to the most recent fixed versions.
The most recent stable release trains for Roundcube Webmail are:
Summary
CVE-2026-48842 is a high-severity pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Risk is elevated because active exploitation has been observed against honeypot instances and because of the product’s historical abuse in espionage-motivated attacks.
Start Your Free Trial
After its release in May 2026, Greenbone’s OPENVAS ENTERPRISE FEED added package detection for CVE-2026-48842 across multiple Linux distributions [1][2][3][4][5][6][7], as well as remote banner detection for CVE-2026-48842 in Windows [8] and Linux [9] instances of Roundcube Webmail. The ENTERPRISE FEED includes regular detection for vulnerabilities affecting Roundcube Webmail, including more recent critical-severity flaws. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
