A critical flaw in Roundcube Webmail has entered active exploitation, the Canadian Centre for Cyber Security reported this week. The vulnerability, which received a patch in May, affects a widely deployed browser-based IMAP email client that serves as the standard mail interface across thousands of hosting providers and millions of user accounts. Roundcube ships as the default webmail solution with cPanel, one of the industry's most common web hosting control panels.
The vulnerability tracked as CVE-2026-48842 resides in the virtuser_query built-in plugin, which manages database-driven user authentication and email address mapping. The flaw allows unauthenticated attackers to bypass login requirements, inject arbitrary database commands, and extract sensitive data from Roundcube installations. These attacks demand no user interaction and operate at high complexity levels.
Roundcube's development team released fixes in versions 1.6.16 and 1.7.1 and strongly urged administrators to deploy the updates immediately. Shadowserver, a threat monitoring organization, has identified more than 523,000 Roundcube instances accessible from the public internet, though the count includes both patched systems and honeypots.
Exploitation confirmed in the wild
Four months after the May patch release, the Canadian Centre for Cyber Security updated its advisory to flag active exploitation. The agency stated that "Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild," and called on system administrators to harden their webmail deployments.
For administrators unable to apply updates immediately, the agency recommends disabling or removing the virtuser_query plugin entirely to close the attack vector. A security patch remains available for those who can upgrade without delay.
Pattern of Roundcube exploitation
Roundcube has emerged as a persistent target for both criminal and state-sponsored threat actors. The Russian group Winter Vivern (TA473) exploited a cross-site scripting zero-day (CVE-2023-5631) to target European government email systems. APT28, a Russian cyber-espionage outfit, leveraged multiple Roundcube flaws (CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026) to compromise Ukrainian government networks.
In February of this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) designated two additional Roundcube vulnerabilities (CVE-2025-49113 and CVE-2025-68461) as actively exploited and mandated that federal agencies patch their systems within three weeks. Since May 2022, CISA has cataloged 11 Roundcube Webmail vulnerabilities as exploited in operational attacks.