Cybersecurity
Roundcube flaw was being actively exploited
Canadian officials said a patched Roundcube Webmail SQL injection flaw was under active exploitation, while outside reporting and internet scans showed exposed instances and earlier abuse of related bugs.
- The Canadian Centre for Cyber Security said CVE-2026-48842 was being actively exploited.
- The flaw affected the virtuser_query plugin in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
- Roundcube released fixes for the issue in May 2026 in versions 1.6.16 and 1.7.1.
- Shadowserver Foundation said more than 523,000 Roundcube instances were exposed to the internet, with 10 flagged as vulnerable on 23 September 2026.
The Canadian Centre for Cyber Security said a patched Roundcube Webmail flaw was under active exploitation and said it was relying on open-source reporting. It did not give further details about how the attacks were being carried out.
The issue was tracked as CVE-2026-48842 and carried a CVSS score of 8.1. It affected the virtuser_query plugin in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
SentinelOne said unauthenticated attackers could inject SQL into Roundcube’s database backend through the plugin and might expose mail credentials and stored messages. Roundcube released patches in May 2026 in versions 1.6.16 and 1.7.1.
Shadowserver Foundation said more than 523,000 Roundcube instances were exposed to the internet, and 10 were flagged as vulnerable on 23 September 2026. Proofpoint said in July 2026 that it had seen a suspected China-aligned actor, UNK_MassTraction, using Roundcube flaws to deploy web shells or VShell, and CISA had already marked two other Roundcube vulnerabilities as actively exploited in February 2026.
Named in this story
Companies
- SentinelOne
- described the SQL injection risk and possible impact
- Proofpoint
- said a China-aligned actor had exploited Roundcube flaws
Organisations
- Shadowserver Foundation
- reported exposed and vulnerable Roundcube instances
Governments and agencies
- Canadian Centre for Cyber Security
- warned that the flaw was being exploited
- U.S. Cybersecurity and Infrastructure Security Agency
- previously marked other Roundcube flaws as exploited
Products and systems
- Roundcube Webmail
- contained the vulnerable virtuser_query plugin
How the source tells it
Matter-of-fact security reporting with a light urgency frame from the active-exploitation warning and exposure figures.
- urgency described the flaw as actively exploited in the wild
- threat framing used exposure counts and vulnerable-host figures to suggest scale