Posted on

Roundcube CVE-2026-48842 – Actively Exploited Pre-Authentication SQL Injection

Threat Overview

CVE-2026-48842 is a pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin. A preg_replace() backslash-escape bypass can allow attacker-controlled input to reach a database query before authentication. Roundcube fixed the issue on May 24, 2026. The Canadian Centre for Cyber Security updated its advisory on September 21 to state that open-source reporting indicates exploitation in the wild, with broader reporting surfacing the exploitation warning on September 25.

References

  • Canadian Centre for Cyber Security, updated September 21, 2026 – Roundcube security advisory AV26-503 Update 1
  • The Hacker News, September 25, 2026 – Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
  • SecurityWeek, September 25, 2026 – Roundcube Webmail Vulnerability in Attackers’ Crosshairs
  • Roundcube, May 24, 2026 – Security updates 1.6.16 and 1.7.1 released

Impacted Systems

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 when virtuser_query is enabled and used. Internet-facing webmail is the primary exposure condition. Current production deployments should use the latest supported security release rather than stopping at the minimum fixed version.

Why this matters

The vulnerable path is reachable before authentication and can expose the Roundcube database. Mail systems contain high-value account, session, identity, and message-related data and are commonly Internet-facing.

Exploitation Status

Active exploitation is reported by the Canadian Centre for Cyber Security based on open-source reporting. No verified attacker attribution, exploit-source IP list, malware family, or reliable HTTP payload signature was available in the reviewed sources.

What this hunt looks for

Pre-authentication web activity against Roundcube, SQL/database errors associated with virtuser_query, unusual PHP/web-server child processes, unexpected file creation, new outbound destinations, and suspicious activity after potential database exposure.

Required logs

Roundcube/PHP/web-server logs forwarded to Syslog, WAF or reverse-proxy telemetry in CommonSecurityLog, and Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents when the server is onboarded.

First Pass – Roundcube and virtuser_query Errors

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("roundcube","Roundcube","virtuser_query")
| where SyslogMessage has_any ("SQL","database","query","syntax","error","exception")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Pre-Authentication Roundcube Web Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("roundcube","webmail")
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Rare Sources to Roundcube Webmail

let Baseline=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(7d))
| where RequestURL has_any ("roundcube","webmail")
| summarize by DestinationIP,SourceIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has_any ("roundcube","webmail")
| join kind=leftanti Baseline on DestinationIP,SourceIP
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction
| order by TimeGenerated desc

PHP or Web Server Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx")
| where FileName in~ ("sh","bash","dash","cmd.exe","powershell.exe","pwsh.exe","python","python3","curl","wget")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

Unexpected Web-Process File Creation

DeviceFileEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx")
| where ActionType in~ ("FileCreated","FileModified")
| where FileName endswith ".php" or FileName endswith ".sh" or FileName endswith ".py" or FileName endswith ".ps1"
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Web-Process Outbound Connections

DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx")
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

New Web-Process Destinations

let Baseline=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(7d))
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx")
| summarize by DeviceId,RemoteIP,RemoteUrl;
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx")
| join kind=leftanti Baseline on DeviceId,RemoteIP,RemoteUrl
| project Timestamp,DeviceName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Roundcube Linux Syslog Fallback

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("roundcube","Roundcube","virtuser_query")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Detection Notes

No verified exploit request signature or IOC list was available, so the HTTP hunts intentionally do not invent SQL payload strings. The highest-confidence exposure check is product/version plus virtuser_query enablement. Endpoint child-process and file-creation hunts are post-compromise pivots. CommonSecurityLog should be scoped to known Roundcube destinations.

Leave a comment