Roundcube is the webmail interface quietly running on a very large fraction of the world’s shared-hosting stacks. cPanel installs it by default. Many Plesk and ISPConfig setups do too. Most sysadmins configure it once, move on, and never think about it again — which is precisely what makes CVE-2026-48842 worth paying attention to right now.

The flaw is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds. The Canadian Centre for Cyber Security issued a formal exploitation warning on September 21. Singapore’s Cyber Security Agency followed on October 3. As of this writing, the attacks are ongoing and no credentials are needed to trigger the flaw.

What the flaw actually is

CVE-2026-48842 is rated CVSS 8.1 (High) and classified as CWE-89 — SQL injection. The root cause is a mismatch between two escaping mechanisms.

Roundcube’s database abstraction layer sanitises input using $dbh->escape(), which adds backslashes before special characters. The virtuser_query plugin then passes that escaped string through PHP’s preg_replace() for placeholder substitution. The problem: preg_replace() interprets backslashes in its replacement argument as metacharacters. An attacker can craft input that causes those backslashes to be consumed by preg_replace(), stripping the escaping and landing unsanitised content directly into the SQL query.

No authentication is required. The attack hits the Roundcube login page — the most exposed surface any server has.

The fix was to replace preg_replace() with str_replace(), which does not interpret backslash sequences in the replacement string. Correct, and in hindsight, obvious.

Which versions are affected

Roundcube 1.6.0 through 1.6.15 and Roundcube 1.7.0 are affected. The first patched releases were 1.6.16 and 1.7.1, both published in May 2026.

The Roundcube project has released further updates since then. As of September 2026, the recommended versions are 1.6.19 (the 1.6.x long-term branch, security fixes only) and 1.7.4 (the current branch). If you’re already on 1.6.16 or 1.7.1, you’re protected from CVE-2026-48842 specifically — but running a months-old release when further patches have shipped is not a maintenance posture worth defending.

What’s actually at risk

Successful SQL injection against a webmail backend is not limited to reading query output. Depending on how your database permissions are configured, an attacker may be able to read stored mail account credentials, enumerate all users in the system, extract configuration values, or interfere with how messages are processed and delivered.

Roundcube typically connects to MariaDB or MySQL as a database user with relatively broad permissions within its own schema. If that user also has visibility into adjacent schemas — a common outcome of hasty hosting setups — the blast radius grows.

Shadowserver recorded more than 523,000 internet-exposed Roundcube instances as of late September 2026. A pre-auth SQL injection with a public proof-of-concept and active exploitation reports is exactly the kind of flaw that gets mass-scanned within hours of advisories going out.

Checking your installation

To find the installed version, look for:

grep 'RCMAIL_VERSION' /path/to/roundcube/program/include/iniset.php

The path varies. cPanel typically installs Roundcube under /usr/local/cpanel/base/3rdparty/roundcube/. Plesk on Debian-based systems uses /usr/share/roundcubemail/.

To verify whether the virtuser_query plugin is active:

grep -r 'virtuser_query' /path/to/roundcube/config/

If that search returns nothing, or finds only commented-out lines, the vulnerable plugin is not loaded. That reduces your immediate exposure, but it does not make an unpatched version safe — configurations change, and upgrading is still the correct action.

What this means for kalfaoglu.net customers

If your hosting plan includes webmail access, you are almost certainly using Roundcube. We update Roundcube as part of routine server maintenance. If you manage your own VPS or dedicated server, verify your version now and upgrade if you are below 1.6.16 or 1.7.1, with 1.6.19 or 1.7.4 as the preferred target.

The attack requires no credentials and targets the login page — meaning it is reachable before any session is established. There is no mitigation that substitutes for the patch.