Canada Warns of Exploited Roundcube Webmail SQLi in CVE-2026-48842

En bref

• CVE-2026-48842 affects Roundcube Webmail releases 1.6.x and 1.7.x through the virtuser_query plugin.
• The flaw allows SQL injection before authentication and is under active exploitation.
• Canada's cyber defense center issued a warning; a patch is available.
• Unknown attackers are suspected, and defenders should prioritize upgrades and detection.

In September 2026, Canada's cyber defense center issued a warning about a vulnerability in Roundcube Webmail that is already being used in attacks. Tracked as CVE-2026-48842, the bug sits in the virtuser_query component and permits SQL injection before a user logs in. The attackers behind the activity have not been identified, and a fix has been released.

Anyone operating Roundcube Webmail 1.6.x or 1.7.x should assume exposure, particularly if the virtuser_query plugin is enabled and the service is reachable from the internet. Because no authentication is required, an attacker could interact with backend databases, potentially reading or altering mail-related data, credentials, or session material. K-12 districts and public-sector teams that rely on webmail for staff and student communications face both data-loss and account-takeover risks.

Roundcube is a widely deployed open-source webmail client, and optional plugins often broaden the attack surface. The Canadian alert underscores that this is not a theoretical issue: exploitation has been observed, and the flaw has been fixed, meaning unpatched instances are unnecessarily exposed. Organizations should treat any delay in updating as an active risk.

Defenders should watch web and database logs for unusual queries, errors tied to the plugin, or authentication anomalies. They should also confirm whether their version is affected, apply the vendor patch, and monitor advisories from the Canadian cyber center and Roundcube maintainers for further updates. If exploitation is suspected, isolate the host, rotate credentials, and preserve logs for investigation.

À faire maintenant

1. Identify all Roundcube Webmail deployments and confirm whether they run 1.6.x or 1.7.x and have virtuser_query enabled.
2. Apply the vendor patch immediately; if patching cannot be completed, disable the virtuser_query plugin or restrict access to trusted networks.
3. Place webmail behind MFA, a WAF, and rate limiting, and block or alert on suspicious SQLi patterns targeting plugin endpoints.
4. Review logs for pre-auth requests to virtuser_query, unusual database errors, and unexpected outbound connections.
5. Rotate database, mail, and administrative credentials if compromise indicators appear, and invalidate active sessions.
6. Subscribe to Canadian cyber center and Roundcube advisories; maintain offline backups and test restore procedures.
7. For internet-facing instances, conduct a vulnerability scan and consider temporary isolation until patched.

Références CVE

• CVE-2026-48842

Source originale

The Hacker News