Cybersecurity
Canada warns Roundcube flaw is under attack
Canada’s cyber security agency said attackers were exploiting a Roundcube Webmail SQL injection flaw patched in May, and advised administrators to update or remove the affected plugin.
- The Canadian Centre for Cyber Security said attackers were actively exploiting CVE-2026-48842, a Roundcube Webmail flaw patched in May.
- Roundcube said the bug was an SQL injection issue in the virtuser_query plugin that worked before authentication.
- The article said a successful exploit could let an attacker bypass login checks, run database commands and take data from Roundcube’s database.
- Roundcube recommended installing versions 1.6.16 or 1.7.1, and the Cyber Centre told administrators to update or disable virtuser_query.
- Shadowserver said more than 523,000 Roundcube instances were exposed on the internet, although it could not say how many were honeypots or already fixed.
The Canadian Centre for Cyber Security said attackers were actively using CVE-2026-48842, a Roundcube Webmail flaw fixed in May. The Centre updated its advisory after saying open-source reporting showed the bug being used in the wild.
Roundcube security staff had described the issue as an SQL injection in the virtuser_query plugin that did not require authentication. The article said exploitation could let an attacker get past login checks, run database commands and steal data from Roundcube’s database.
Roundcube recommended upgrading to versions 1.6.16 or 1.7.1. It also said administrators who could not upgrade at once should remove or disable virtuser_query to close the route used in the attacks.
Shadowserver said it tracked more than 523,000 Roundcube instances exposed to the internet, but it could not tell how many were honeypots or already patched. The article also said Winter Vivern (TA473) and APT28 had previously abused Roundcube flaws, and that CISA had marked two other issues as actively exploited in February.
Named in this story
Organisations
- Roundcube security team
- patched the flaw in May and recommended updates
- Shadowserver
- tracked more than 523,000 exposed Roundcube instances
- Winter Vivern (TA473)
- had previously exploited a Roundcube zero-day
- APT28
- had previously abused Roundcube flaws against Ukrainian government email systems
Governments and agencies
- Canadian Centre for Cyber Security
- updated its advisory to warn that the flaw was being actively exploited
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- flagged two other Roundcube flaws as actively exploited in February
Products and systems
- Roundcube Webmail
- the affected webmail client
- virtuser_query
- the plugin where the injection flaw sat
How the source tells it
The register was that of a straight security advisory, but it leaned on urgency and scale to stress immediate risk.
- urgency active-exploitation language and repeated instructions for administrators to act
- alarm severity labels and large exposed-instance counts used to heighten the sense of risk