Roundcube CVE-2026-48842 Active Exploitation and Patch Pressure

Attackers are actively exploiting **CVE-2026-48842** in **Roundcube Webmail**, turning a flaw patched in May into an immediate risk for internet-facing mail servers. The vulnerability is a pre-authenticated SQL injection in the **virtuser_query** built-in plugin and can let an unauthenticated attacker bypass authentication, execute malicious database commands, and steal data from Roundcube's database. Affected versions include **1.6.x before 1.6.16** and **1.7.x before 1.7.1**. Current defensive guidance is to upgrade to **1.6.16** or **1.7.1** and, if that cannot be done immediately, disable or remove **virtuser_query**. Available reporting also describes a broad internet-facing surface, with more than **523,000 Roundcube instances** exposed and **10 hosts** flagged as vulnerable as of September 23, 2026; those figures describe exposure and identified vulnerable hosts, not confirmed compromises. Available evidence does not identify a confirmed victim count, a named operator for this exploitation, or a quantified data-loss total. The sequence has moved from vendor remediation into active exploitation warnings from the Canadian Centre for Cyber Security, so the main change is confirmation that unpatched Roundcube deployments are now being targeted. The operational priority is to find exposed Roundcube systems using the vulnerable plugin, patch them, and disable or remove **virtuser_query** wherever immediate upgrading is not possible.