Security researchers and Canada's national cyber-security agency have confirmed that attackers are actively exploiting a critical flaw in Roundcube, one of the most widely used open-source webmail systems on the internet. The bug, tracked as CVE-2026-48842 (CVSS 8.1), sits in a plugin called virtuser_query and lets an attacker send a specially crafted request that injects and runs SQL commands against Roundcube's database — with no username or password required. A successful attack can expose whatever is stored in that database.
Roundcube patched the flaw back in May 2026 (versions 1.6.16 and 1.7.1), but the Canadian Centre for Cyber Security updated its advisory this week to warn that the bug is now being exploited in the wild, months after the fix shipped. Security researchers at Shadowserver are still tracking more than 523,000 Roundcube installations reachable from the internet, a large share of which are likely still unpatched. Roundcube isn't a niche product — it's the default browser-based webmail bundled with countless hosting control panels, so a large number of small businesses run it without ever having chosen it deliberately.
What this means for your business
If your business reads email through a browser "webmail" login provided by your hosting company, there's a good chance it's Roundcube under the hood — check the login page for the Roundcube name, or simply ask your host this week whether their webmail runs on Roundcube and, if so, whether it's on version 1.6.16/1.7.1 or later. If you or your IT provider manage a self-hosted Roundcube instance, upgrade immediately; if an immediate upgrade isn't possible, disabling the virtuser_query plugin removes the specific flaw being exploited. Because this bug needs no password to work, treat any unpatched, internet-facing instance as already at risk — and if you have reason to think yours was exposed, rotating the affected email account passwords afterwards is a reasonable precaution.