{"id":3154,"date":"2026-09-25T10:24:37","date_gmt":"2026-09-25T10:24:37","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3154"},"modified":"2026-09-25T10:24:37","modified_gmt":"2026-09-25T10:24:37","slug":"roundcube-pre-auth-sql-injection-flaw-actively-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3154","title":{"rendered":"Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 25, 2026<\/span><\/span>Vulnerability \/ Email Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.<\/p>\n

The vulnerability in question is CVE-2026-48842<\/strong> (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.<\/p>\n

The issue stems from a preg_replace() backslash escape bypass that allows attackers to inject arbitrary SQL statements without authentication.<\/p>\n

\u00abUnauthenticated attackers can inject SQL into Roundcube’s database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages,\u00bb SentinelOne said<\/a>.<\/p>\n

Patches for the vulnerability were released<\/a> by Roundcube in May 2026 as part of 1.6.16 and 1.7.1.<\/p>\n

In an update shared this week, the Cyber Centre said<\/a> the security flaw is being actively exploited in the wild, citing open-source reporting. No additional details of the exploitation activity have been disclosed.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Data from the Shadowserver Foundation shows that there are more than 523,000 Roundcube instances<\/a> exposed to the internet, with 10 of them flagged<\/a> as vulnerable hosts as of September 23, 2026.<\/p>\n

Vulnerabilities in Roundcube have been an attractive target for threat actors looking to harvest sensitive email communications. In July 2026, Proofpoint said it identified a suspected China-aligned adversary dubbed UNK_MassTraction exploiting known security flaws in Roundcube to deliver web shells or a post-exploitation tool called VShell.<\/p>\n

Way back in February 2026, two other vulnerabilities in the same product (CVE-2025-49113 and CVE-2025-68461) were tagged as actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Sep 25, 2026Vulnerability \/ Email Security The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability…<\/p>\n","protected":false},"author":1,"featured_media":3155,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[201,128,70,525,1040,202,562,656],"class_list":["post-3154","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-actively","tag-exploited","tag-flaw","tag-injection","tag-preauth","tag-roundcube","tag-sql","tag-wild"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3154"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3154\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3155"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}