What broke

CVE-2026-48842 is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. Roundcube fixed it on 24 May 2026 in 1.6.16 and 1.7.1. On 21 September, the Canadian Centre for Cyber Security updated advisory AV26-503 to note it is being exploited.

The interesting part is not that a four-month-old patch is being attacked. It is how the bug happened, because it is a mistake that is easy to make and hard to see in review.

The plugin builds SQL by substituting the submitted username into an administrator-supplied query template. It escapes the value first — correctly — and then passes the escaped string to preg_replace() as the replacement argument.

In PCRE, the replacement string is not literal. Backslashes there are meta-syntax. So the second function consumes the very backslashes the escaper had just inserted, and the quote character they were protecting survives into the final statement.

The bug is not a missing escape. It is a correct escape destroyed by the function that ran next. CWE-89 describes the outcome; CWE-116, improper encoding of output, describes the cause better.

The fix is four lines: preg_replace() becomes str_replace(), which does not reinterpret its replacement. Worth noting that the fix preserves the escape-and-concatenate design rather than moving to prepared statements — it closes this instance rather than the class.

Who is actually affected

Here is where nearly all the coverage goes wrong.

You will read that 500,000-plus Roundcube servers are internet-facing. The real figure is around 523,000, from Shadowserver. It counts exposed instances. It does not count vulnerable ones.

Shadowserver flagged roughly ten instances as vulnerable as of 23 September.

That is not a rounding difference. Used as a vulnerability figure, the 523,000 number is wrong by about five orders of magnitude — and it is the number driving emergency change requests this week.

The reason the gap is so wide is that two conditions must both hold:

  1. virtuser_query must be in your plugin list. Roundcube ships with $config['plugins'] = []; — an empty list. The plugin is bundled but disabled.
  2. At least one SQL query template must be configured. Without $config['virtuser_query'] populated, the plugin registers no hooks at all and is completely inert.

A stock Roundcube install is not vulnerable to this.

The check that settles it

Before you schedule anything, grep your config:

grep -n "virtuser_query" config/config.inc.php

If it does not appear in the plugins array, or appears with no query templates configured, this CVE does not apply to that host. For most readers that is the entire job, and it takes a minute.

I could not find credible data on how commonly hosting panels or virtual-mailbox stacks enable the plugin, so I am not going to guess at it. Check rather than assume in either direction.

Is it being exploited?

Reported, yes. Independently corroborated, not really — and the distinction matters.

The Canadian Centre for Cyber Security’s wording is precise: “Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.” That is CCCS relaying reporting, not first-party telemetry. There is no named actor, no victim, no campaign, no timeline and no indicators. Every downstream article traces back to that one sentence.

It is not in CISA KEV — I checked catalog version 2026.09.25, which is current, and it is absent. Eleven other Roundcube CVEs are in KEV, which is part of why this gets conflated.

And a note on headlines: one major outlet is calling this “code injection attacks” while its own body text correctly says SQL injection, and another framed it as a US government warning when the advisory is Canadian.

EPSS sits at 0.00891, the 57.7th percentile. For once, a low EPSS score and the reality are not in tension — the non-default-configuration precondition genuinely does limit this.

What to patch

Do not patch to 1.6.16 or 1.7.1. Those fixed this CVE but have been superseded twice. Current is 1.6.19 / 1.7.4, released 6 September, fixing twelve further issues including a zero-click stored XSS.

And the affected range is wider than NVD says. NVD lists 1.6.0–1.6.15 and 1.7.0. The same defective pattern is present in 1.4.x and 1.5.x, which are end-of-life and will not be fixed. A post repeating NVD’s range implies 1.5.x is safe. It is not — it is unfixable. Migrate off it.

If you cannot patch immediately, disable the virtuser_query plugin and apply least privilege to the Roundcube database account.

How to detect it

No IOCs, Sigma rules, Suricata signatures or Nuclei templates exist for this CVE. Greenbone has coverage, but it is version and package detection — useful for finding unpatched hosts, useless for finding attacks. I would rather say that plainly than dress up generic advice as threat intelligence.

What you can do follows from the mechanism:

  • The injection point is the username or email submitted at login. Look in web server access logs for quote and backslash characters in submitted login identifiers. Neither has a legitimate use there.
  • The vulnerable queries run before authentication succeeds, so the signal is database activity correlated with failed or incomplete logins.
  • Turn on database error logging. A malformed injection attempt typically produces SQL syntax errors from the Roundcube database user, and those errors are cheap to alert on.

A public probe repository exists on GitHub. That does not change the risk to a correctly configured host, but it does lower the barrier to opportunistic scanning, which is usually what precedes a wave of noise in your logs.

Do not confuse it with the other Roundcube CVEs

Four separate sources of confusion are in circulation right now:

  • CVE-2025-49113 (deserialization, RCE) and CVE-2025-68461 (XSS) — both genuinely in KEV since February 2026. These are the Roundcube bugs with federal exploitation confirmation.
  • CVE-2026-75003 — the trap. NVD carries two conflicting scores: 5.8 from the CNA and 9.8 from NVD. It is an SVG url() parsing issue that bypasses remote-image blocking — a privacy and content-blocking problem. Third-party sites are propagating the 9.8 as “critical Roundcube flaw”. It is not this CVE, and its severity is disputed by the CNA’s own score.
  • CVE-2026-75004 — managesieve rule-name quoting, CVSS 4.3. Structurally interesting because it carries the same caveat: it only affects instances using the managesieve plugin. Roundcube’s plugin-gated CVEs are routinely reported without their preconditions.

The pattern worth taking away

This vulnerability is real, the patch is four months old, and you should be on a current release regardless.

But the story being told about it — half a million servers at risk from an actively exploited critical flaw — is built from three separate numbers that each mean something narrower than the sentence implies. Exposure is not vulnerability. Relayed reporting is not confirmed exploitation. A CNA score is not an NVD score.

Check the config. It is one grep, and for most estates it ends the conversation.

References