Attackers Target Unpatched Roundcube Servers With CVE-2026-48842

Threat actors are exploiting an unpatched SQL injection vulnerability (CVE-2026-48842) in older versions of the Roundcube email server, months after a fix was released. Roundcube patched the flaw in May, but attackers are now targeting systems that haven't installed the update. The vulnerability, found in Roundcube versions before 1.6.16 and before 1.7.1, allows attackers to interfere with database queries through a backslash-escape bypass.

Because the flaw is pre-authentication, an attacker can exploit it without valid Roundcube credentials. The Canadian Center for Cyber Security reports that over 523,000 Roundcube instances are currently exposed on the internet, highlighting the extent of the issue. While updates typically take time to reach every system, threat actors benefit from patches by gaining visibility into the vulnerability, enabling them to target unpatched installations.

Organizations should promptly apply the security update to prevent exposure of their internet-facing email systems to this actively exploited vulnerability.