A high-severity vulnerability in Roundcube Webmail, patched in May 2026, is now being actively exploited in code injection attacks, according to the Canadian Centre for Cyber Security. The flaw, tracked as CVE-2026-48842, allows unauthenticated attackers to bypass security controls and execute malicious database commands, putting millions of email users at risk.
Roundcube is a browser-based IMAP email client used as the default mail interface by thousands of services and is pre-installed with the widely adopted cPanel web hosting control panel. The vulnerability resides in the virtuser_query plugin, which handles database-driven user lookups and maps users to email addresses. Successful exploitation enables threat actors with no privileges to inject and execute malicious SQL commands, steal data from Roundcube's database, and compromise email systems without requiring any user interaction.
The Roundcube security team addressed this issue in May by releasing patches in versions 1.6.16 and 1.7.1, strongly recommending that administrators update their servers immediately. For those unable to upgrade right away, disabling or removing the virtuser_query plugin eliminates the attack vector and reduces exposure. Despite the availability of fixes, Shadowserver currently tracks over 523,000 Roundcube instances exposed on the Internet, though it remains unclear how many are honeypots or already patched against this flaw.
This is not the first time Roundcube has been targeted by sophisticated threat actors. The Russian Winter Vivern (TA473) group exploited a cross-site scripting zero-day (CVE-2023-5631) against European government entities, while APT28 abused multiple Roundcube flaws to breach Ukrainian government email systems. More recently, in February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged two other Roundcube vulnerabilities as actively exploited, ordering federal agencies to secure their networks within three weeks. Since May 2022, CISA has tagged 11 Roundcube Webmail vulnerabilities as exploited in the wild, underscoring the platform's persistent appeal to cybercriminals and state-backed hackers.
Organizations relying on Roundcube should prioritize patching to versions 1.6.16 or 1.7.1 without delay, as the window for safe operation has closed. Administrators who cannot upgrade immediately must disable the vulnerable virtuser_query plugin and monitor logs for suspicious database queries or unauthorized access attempts. Given the scale of exposed instances and the history of active exploitation, treating this flaw as a critical priority is essential to prevent data theft, credential harvesting, and broader compromise of email infrastructure.
