If you run Roundcube webmail for company email, confirm you are on version 1.6.16 or 1.7.1 or newer today: an unauthenticated SQL injection flaw, CVE-2026-48842, was fixed back in May and is now confirmed as being exploited in the wild. This note is for the business owner or IT lead who runs, or whose hosting provider runs, Roundcube as the login screen for company mail. The job today is small and specific: know your version, confirm the patch is on, and if you do not manage the mail server yourself, ask your host one direct question.
CVE-2026-48842 was added to VulnCheck’s Known Exploited Vulnerabilities catalog on September 21, 2026, which is what moved this from a routine advisory to a today problem. A spot in that catalog means confirmed exploitation, not a theoretical risk. As of this writing there is no mainstream trade-press coverage yet, so if you act now you are ahead of the news cycle, not behind it.
What this Roundcube webmail SQL injection lets an attacker do
In plain English: a feature that is supposed to look up which mailbox an address belongs to can be tricked, without logging in, into running commands against the database instead.
SQL injection is when input that should be treated as plain data (a username, an address) gets treated as a database instruction. The database does what the attacker’s text says instead of what the application meant. Here, the flaw lives in how Roundcube’s virtuser_query feature builds its lookups. A backslash-escape step meant to make the input safe can be bypassed, so a crafted request reaches the database as a command. The GitHub Security Advisory has the full technical detail if your IT person wants it.
Two things make this one worth attention. It needs no login, so the attacker does not have to already be inside or have stolen a password. And it is scored 8.1 High because a webmail database usually holds real things: account records, message contents, sometimes stored credentials for other systems.
Is this actually being exploited, or just another advisory
It is being exploited. That is the point of the VulnCheck listing dated today. The patch itself is not new, which is the part worth understanding.
Roundcube shipped the fix in versions 1.6.16 and 1.7.1 on May 24, 2026, as part of a release that closed eight issues, this pre-auth SQL injection being the most serious. So the situation is not a brand-new emergency patch you have to scramble for. It is a four-month-old fix that plenty of installs never applied, and attackers have now started using the gap. If you patch on a normal cadence, you are likely already covered and this is a two-minute confirmation. If webmail is one of those things nobody has touched since it was set up, this is the nudge to check.
One caution so you do not chase the wrong thing: Roundcube had a couple of unrelated flaws added to CISA’s catalog back in February 2026. Those were different bugs. This is a separate, newer issue. Do not assume a fix you applied in the spring for something else covered it.
Are you exposed
Start here, because it is easy to skip straight to panic: running Roundcube webmail is not a problem. Webmail is supposed to exist. A login page for your company email being reachable is normal infrastructure, not a finding. The question is whether it is patched, and whether the vulnerable feature is even turned on.
There are really two situations, and they call for different first moves.
| Your setup | Who runs Roundcube | Your first move |
|---|---|---|
| Company email through a web host, cPanel, or control panel | Your provider does | Ask them the version and whether they have patched to 1.6.16 or 1.7.1 |
| Self-hosted mail server you or your IT team manage | You do | Check the version and whether virtuser_query is configured, then upgrade |
Most small and mid-sized businesses are in the first row and do not realize it. Your email might route through a hosting provider or a control-panel stack, and Roundcube is simply the webmail face on it. In that case you do not patch anything yourself. You send one email. Something like: “Are we running Roundcube webmail, and if so, are we on version 1.6.16 or 1.7.1 or later, which fixes CVE-2026-48842?” A provider that is on top of things will answer quickly.
If you self-host, you can check directly. The exploitation path runs through virtuser_query, a feature that maps virtual mail users to a SQL backend, which is common on multi-domain and hosting setups and often absent on a simple single-domain install using static configuration. If it is not enabled, your exposure to this specific bug is much lower. That is a real reason to breathe, not a reason to stay on an old version. Optional features get turned on later, and one bug being hard to reach today does not make an unpatched webmail platform a good idea.
What to do today
A short list, in order.
- Find your version. Log in to webmail and open Settings, then About. It shows the Roundcube version. If you cannot log in or do not have an account, move to step two.
- If a provider runs your mail, ask them. Use the one-line question above. This is the whole task for most businesses. You are confirming, not fixing.
- If you self-host, upgrade. Get to 1.6.16 or 1.7.1 or later. If you cannot upgrade immediately, confirm whether
virtuser_queryis set in your configuration; if it is not, your window is smaller, but schedule the upgrade anyway. - If webmail was reachable from the internet and you are unsure, look back. Have whoever manages the database and web logs check for unusual query patterns or errors from the webmail application over recent weeks. Confirmed exploitation in the wild means “was I already probed” is a fair question, not paranoia.
None of this requires a project. For most readers it is one email and a version number.
Would attackers really bother with a small business
They do not have to pick you by name. This is worth saying plainly because it changes how you weigh the risk.
Flaws like this get exploited at internet scale. Once a bug is public and confirmed exploited, automated tools sweep large ranges of addresses looking for Roundcube login pages and trying the request that triggers it. Nobody sits down and decides to target a specific clinic in Mesa or a law office in Tucson. The scan finds a reachable, unpatched install and moves on to the next one, and a small business is exactly as reachable as a large one. So “we are too small to be worth it” is not the protection it feels like. The thing that actually keeps you off that list is being patched, which is also the cheapest item on today’s checklist.
Why a webmail flaw matters as much as a server flaw
Webmail sits directly in front of your company’s email, and email is where password resets, contracts, and account details live. Its database frequently shares a server with other things. An unauthenticated SQL injection there is not “the webmail looks weird.” It can mean reading stored messages or credentials, which is a foothold into far more than the inbox.
The broader lesson is the quiet one azpentest keeps coming back to. The risk here was not exotic. The fix existed for four months. What turns a patched-in-May advisory into a live incident is nobody knowing what version is running or whether it was ever updated. Knowing what you have on the internet, what version it is on, and whether it is current, before someone else checks for you, is most of the job. An external penetration test is the independent version of that check across everything facing the internet, not just webmail, and patch status is one of the cyber-insurance questionnaire items that comes up most.
Not sure whether your webmail, or anything else reachable from outside, is running a current, patched build? Tell us a little about your setup and what is prompting the question, and we will come back with a fair, fixed quote. Request a quote.
Want to know where you stand?
Tell us a little about your business and what is prompting the test. We will come back with a fair, fixed quote.
Request a quote