The login page for your company email is also an unauthenticated door into the database behind it. Most teams have never looked at it that way, and that is exactly the gap attackers are walking through this week.
On September 24, 2026, the Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail. The patch shipped on May 24, 2026. That is four months of warning, and it still landed.
The 30-second version
- CVE: CVE-2026-48842, CVSS 8.1 (High)
- Product: Roundcube Webmail, the open-source webmail client that quietly powers a very large share of self-hosted mail
- Affected: 1.6.x before 1.6.16, and 1.7.x before 1.7.1
- Impact: unauthenticated SQL injection over the network. No account, no login, no user interaction
- Fixed in: 1.6.16 and 1.7.1, released May 24, 2026
- Status: exploited in the wild, per Canadian Centre for Cyber Security advisory AV26-503
If you run Roundcube and you have not touched it since spring, assume you are exposed until proven otherwise.
Where the flaw actually lives
This one is a good reminder that the risky part of your stack is rarely the part you think about.
The bug sits in virtuser_query, a built-in plugin that resolves which email address belongs to which user by querying the database. It is the sort of plugin that gets enabled years ago to make a mail migration work, then survives three redesigns because nothing broke.
The plugin tries to sanitize input with a regular expression before it hits the query. The escaping logic can be bypassed with crafted backslash sequences, and once that happens, attacker-controlled text stops being data. It becomes SQL. The database then answers questions the attacker was never supposed to be able to ask.
Because the injection fires before authentication, there is no credential to steal first and no session to hijack. The attacker simply has to reach the webmail endpoint. In most architectures, that endpoint is on the public internet, because people need to read their mail from airports.
Email is the master key, not a side quest
We keep writing about this and it keeps being true: your mail server is the highest-value system on your network, and it is usually the least maintained.
Think about what sits behind a webmail login. Password reset links for every SaaS tool your company uses. Contracts, invoices, and bank correspondence. Password-reset flows for the infrastructure itself. A session hijacked here is not one account lost, it is a chain of resets initiated from a trusted source, and a mailbox that your security team cannot see into.
And the data sitting in the Roundcube database is not just mail. Depending on the deployment, it holds identity mappings, contact records, and mail metadata. A pre-auth SQL injection means the attacker can start pulling from that well immediately.
Four months is not a short window, it is a missed one
Roundcube shipped 1.6.16 and 1.7.1 on May 24, 2026. The advisory is now four months old, and the exploitation confirmation is fresh. Somewhere between those two dates, the queue of unpatched servers did not shrink the way it should have.
This pattern has become the dominant story of 2026: the flaw is not exotic, the fix already exists, and the gap is operational. Roundcube is a dependency, not a product with a vendor account manager, so it does not appear in procurement reviews, executive dashboards, or quarterly patching slide decks. It lives on a VM, in a container, or inside a control panel stack, and it waits.
We have watched this before this month alone. An actively exploited Check Point flaw where the patch existed before the attacks. An F5 BIG-IP APM zero-day on the identity data plane. The technical details change. The operational failure repeats.
Mitigation without a maintenance window
If you cannot reach 1.6.16 or 1.7.1 today, disable virtuser_query until you can. If your deployment genuinely depends on it for user lookups, treat the upgrade as emergency work with a maintenance window, not as a backlog item.
What we would do this week
- Inventory every Roundcube instance, including the ones hiding inside hosting control panels, mail-in-a-box stacks, and forgotten staging environments. The vulnerability does not care whose name is on the invoice.
- Check versions and patch today. 1.6.16 or 1.7.1, nothing older. Verify by version string, not by a maintenance note in the ticket.
- If you cannot patch immediately, disable virtuser_query. Removing a plugin is an ugly fix, but it closes the door tonight.
- Audit what could have been read. Search webmail, PHP, and database logs for unusual query volume, error bursts, or requests that look automated. A four-month patch gap is a four-month evidence window.
- Stop treating self-hosted mail as background infrastructure. If it holds password resets for your whole stack, it belongs in your critical asset register and your patch SLA.
The takeaway for our clients
When we do architecture reviews, the systems that surprise us are almost never the ones with a team. They are the ones nobody owns: the mail server that came with a hosting plan, the plugin that made a migration work in 2023, the VM that exists only in a screenshot.
Roundcube's CVE-2026-48842 is not a hard bug. It is a pre-auth injection in a plugin most administrators have never opened, in a component most businesses treat as furniture. Patch the four-month-old fix, turn off the plugin you forgot you shipped, and treat the thing that resets every password you own like it is genuinely critical. Because this week, someone else already is.