Canada's Cyber Centre flags live attacks on a pre-login Roundcube SQL injection

The bug is in how virtuser_query escapes input. The plugin resolves an email address to a mailbox username and passes input through preg_replace() with backslash escaping to block injection attempts ^[4]. SentinelOne found that crafted backslash sequences defeat that filter, so quote characters are concatenated into the SQL string sent to the database ^[5]. No login is required ^[3]. BleepingComputer describes the attack as high-complexity, needing neither privileges nor user interaction ^[12].

A successful injection reaches the database behind the webmail. "Unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages," SentinelOne said ^[6]. According to SecurityWeek, Omar Ahmed, information security lead at Paymob, points out that exploitation also gives access to user identities and address books and lets an attacker map authentication workflows and admin functions ^[11].

Exposure depends on that one plugin ^[2]. Disabling or removing virtuser_query eliminates the attack vector, according to BleepingComputer, and that is its fallback for admins who cannot upgrade yet ^[13]. Shadowserver counts more than 523,000 Roundcube instances on the internet and had flagged 10 of them as vulnerable as of September 23, 2026, The Hacker News reported ^[15]. That is about 0.002 percent, or one host in roughly 52,000 ^[18]. SecurityWeek, citing the same foundation, says it is unclear how many of the exposed servers are vulnerable ^[16].

Roundcube is a steady target. CISA has flagged 11 Roundcube Webmail vulnerabilities as exploited since May 2022 ^[22]. In February 2026 it added CVE-2025-49113 and CVE-2025-68461 and gave federal agencies three weeks to secure their networks ^[21]. In July 2026, Proofpoint reported that a suspected China-aligned group it calls UNK_MassTraction was exploiting known Roundcube flaws to deliver web shells or the VShell post-exploitation tool ^[20]. The Russian group APT28 used CVE-2020-35730, CVE-2020-12641 and CVE-2021-44026 to breach Ukrainian government email. Winter Vivern (TA473) used the XSS zero-day CVE-2023-5631 against European government entities ^[23].

"Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," the Cyber Centre said ^[8]. The agency has released no further detail, so none of the reporting ties the new activity to UNK_MassTraction, APT28 or any other named group ^[10][24].