Roundcube CVE-2026-48842 Pre-Auth SQLi Exploited in 10 Exposed Instances Despite May 2026 Patches

The flaw allows direct SQL injection into Roundcube's backend without credentials, risking exposure of mail credentials and stored messages. Shadowserver data from 23 September 2026 shows 523,000 internet-facing instances with exactly 10 still vulnerable after patches shipped in 1.6.16 and 1.7.1 four months earlier. Procurement and incident records indicate repeated targeting of the same component across multiple CVEs.

Proofpoint's July 2026 report on UNK_MassTraction documented China-aligned actors chaining prior Roundcube flaws to deploy VShell and web shells. CISA added CVE-2025-49113 and CVE-2025-68461 to its KEV catalog in February 2026 after observed campaigns. The current exploitation follows the identical pattern of harvesting email for intelligence rather than ransomware deployment.

Open-source telemetry shows patching velocity remains low; contract awards for mail infrastructure rarely include rapid update mandates. Canadian authorities cited only open-source reporting, leaving attribution to technical indicators such as payload structure and post-exploitation tooling.

Expect continued scanning of the remaining vulnerable hosts and secondary compromise of any unpatched instances used by government or defense-adjacent organizations.