What is confirmed
Roundcube fixed CVE-2026-48842 in versions 1.6.16 and 1.7.1 released in May. The issue is a pre-authentication SQL injection in the virtuser_query plugin when used for user lookups.
In a 21 September update, the Canadian Centre for Cyber Security says open-source reporting indicates exploitation in the wild. Its advisory does not quantify attacks or victims.
What it means
SQL injection can permit unintended database queries; precise impact depends on configuration and database privileges. Data theft or authentication bypass should not be assumed for every installation.
This concerns a vulnerability patched in May with exploitation reported in September, not a newly discovered 24 September flaw.
What to do
Inventory Roundcube instances, check version and virtuser_query configuration, then install the latest security release for your supported branch.
If exposed before patching, have the security team review HTTP and SQL logs for anomalous requests. Protect database accounts and secrets if compromise is suspected.
An external check can help triage but cannot verify the installed version or rule out injection in logs.
