ROUNDCUBE developers released security updates on 24 May 2026 for CVE-2026-48842, a high-severity SQL injection vulnerability rated 8.1 on CVSS v3. The Canadian Centre for Cyber Security has confirmed that the flaw is being exploited in the wild. It affects Roundcube 1.6.x versions before 1.6.16 and 1.7.x versions before 1.7.1, where the vulnerable `virtuser_query` plugin is enabled.
The flaw is reportedly pre-authentication and remotely exploitable, allowing an unauthenticated attacker to send specially crafted backslash sequences that bypass the plugin’s input sanitisation. This can result in arbitrary SQL commands being injected into the backend database, potentially exposing email records or compromising database contents. The article does not provide details of specific victims or confirmed attack outcomes.
Administrators should upgrade to Roundcube 1.6.16 or 1.7.1 immediately. If an upgrade cannot be applied, the article recommends temporarily disabling the `virtuser_query` plugin.