Most people who use webmail through their hosting control panel have never thought about what software is actually running it. You click the webmail link, you read your email, you close the tab. The software behind that interface is rarely something you choose. It is just there, quietly handling everything.
That software is called Roundcube in the majority of cases. And right now, attackers are actively exploiting a high-severity vulnerability in it that has been patched since May. If your host has not applied the patch, or if you manage your own server and have not updated Roundcube since spring, here is what you need to know.
What Is Roundcube?
Roundcube is the most widely deployed open source webmail client in the world. If you have ever logged into webmail through cPanel, Plesk, or DirectAdmin and read your email in a browser without setting up Outlook or Apple Mail, there is a good chance you were using Roundcube. It is installed with cPanel by default and available as a bundled package in Plesk and most other control panels. Shadowserver currently tracks over 523,000 Roundcube instances exposed on the internet.
Most people running Roundcube do not know they are running it. That combination: widely deployed, rarely monitored, deployed rather than deliberately chosen, is exactly what makes it a consistent target.
What the Vulnerability Does
CVE-2026-48842 is a pre-authenticated SQL injection in Roundcube’s virtuser_query plugin. The virtuser_query plugin handles database-driven user lookups: it maps users to email addresses. Pre-authenticated means an attacker does not need a login to exploit it. They can bypass authentication entirely, inject malicious database commands, and steal data from Roundcube’s database with no user interaction and no account required.
One important nuance: virtuser_query ships disabled by default in Roundcube. Only servers where an administrator has explicitly enabled it and configured its SQL queries are exposed to this specific flaw. In practice this means cPanel environments where the plugin was enabled during setup, and standalone Roundcube installs configured for virtual user lookups. A standard Roundcube installation with default settings is not affected, which is also why Plesk users are doubly protected, as Plesk neither enables virtuser_query nor uses it in its mail architecture.
The Roundcube team patched the flaw in May, in versions 1.6.16 and 1.7.1. On September 22, the Canadian Centre for Cyber Security updated its advisory to confirm active exploitation. Four months passed between the patch shipping and confirmed attacks in the wild.
BleepingComputer reported on the exploitation on September 24, 2026, citing the Canadian Centre for Cyber Security’s updated advisory.
Are You Affected?
The answer depends on how your hosting is set up.
If you are on managed shared hosting (cPanel): Your host manages Roundcube updates at the server level. Most reputable hosts applied this patch in May when it shipped. Contact your host and ask whether Roundcube has been updated to version 1.6.16 or 1.7.1. If they cannot give you a clear answer, that tells you something about their patching cadence worth knowing regardless of this specific vulnerability.
If you run Plesk: You are protected on two separate fronts. First, Plesk does not enable the virtuser_query plugin in its Roundcube bundle. The specific plugin containing the SQL injection flaw is not active in a standard Plesk setup. Second, Plesk shipped the patched Roundcube version (1.6.16) in Obsidian 18.0.77 Update 5 and 18.0.78 Update 3. If your server is on auto-updates, the patch landed in May. Verify that auto-updates are active in Plesk under Tools and Settings to confirm. Even without the patch, the attack vector for CVE-2026-48842 is not present in a standard Plesk configuration.
If you manage your own server with Roundcube installed manually: Check your version now. Log into webmail and look for the version number in the footer or under Settings. If it is below 1.6.16 on the 1.6.x branch or below 1.7.1 on the 1.7.x branch, update immediately. If you cannot update right now, disabling or removing the virtuser_query plugin eliminates the specific attack vector for this CVE without taking webmail offline entirely.
The Bigger Picture: Roundcube Is a Consistent Target
A single vulnerability getting actively exploited four months after patching is not unusual. What is unusual about Roundcube is the pattern behind it. Since May 2022, CISA has tagged 11 separate Roundcube vulnerabilities as actively exploited in the wild. CVE-2026-48842 is not yet on that list as of publication. That is not a product with an occasional security issue. It is a product that serious attackers return to regularly.
The reasons are not hard to understand. Email is one of the highest-value targets on any server. It contains credentials, financial data, sensitive communications, and two-factor authentication codes. A pre-authenticated bypass that gives database access to a webmail client is a serious prize. And webmail software tends to receive less security attention than the main web application running on the same server. It is the software that was just there, pre-installed, rarely updated unless something breaks.
The attackers targeting Roundcube are not always opportunistic. The Russian state sponsored group APT28 exploited multiple Roundcube flaws to breach Ukrainian government email systems. Winter Vivern, a Russian-aligned threat group, exploited a Roundcube zero-day against European government entities. In February 2026, CISA flagged two further Roundcube flaws as actively exploited and ordered government agencies to patch within three weeks. A product that has been targeted by state sponsored actors across three continents is one that deserves more active management than “it came pre-installed and I have not thought about it since.”
This mirrors what we have seen in cPanel security vulnerabilities is worth noting. Infrastructure software (control panels, webmail clients, database tools) tends to get exploited precisely because it is treated as invisible background infrastructure rather than attack surface requiring active maintenance.
Should You Switch Webmail Client?
For most people on managed shared hosting, this decision is not theirs to make. The host controls which webmail client is available. But for anyone managing their own server or running Plesk, it is worth understanding what the alternatives actually offer.
Stay on Roundcube
For most server administrators, keeping Roundcube and keeping it updated is the right answer. The project is actively maintained, patches ship promptly, and Roundcube 1.7.2 and 1.6.17 shipped in July 2026 with fixes for further XSS and SSRF vulnerabilities. The problem with Roundcube is not that it is poorly built. It is that parsing untrusted HTML email is an inherently difficult security problem and the attack surface is large. A current, patched Roundcube installation is not a liability. An outdated, unmonitored one is.
Switch to SnappyMail
SnappyMail is the actively maintained fork of RainLoop. RainLoop was abandoned by its original developer in 2022. If you are still running RainLoop today, migration is not optional. An unmaintained webmail client that parses hostile HTML from strangers is one of the more dangerous things to leave on a server. SnappyMail took the RainLoop codebase, modernised it, and has been releasing regular security updates since taking over.
The key advantage over Roundcube is the absence of a database dependency. Roundcube requires MySQL or MariaDB. SnappyMail does not. CVE-2026-48842 exploited Roundcube’s database layer directly. A webmail client without a database removes that entire attack surface. SnappyMail also uses a single page application architecture which makes it faster than Roundcube, runs on significantly less memory, and is available as a Plesk extension you can install and test alongside Roundcube before committing to a switch.
The tradeoff: no calendar, no contacts, no CalDAV or CardDAV sync. If you only use webmail for reading and sending email, SnappyMail is the cleanest switch with the lowest ongoing attack surface. If you need those groupware features, read the SOGo section below.
Switch to SOGo
SOGo is groupware rather than a simple webmail client. It handles email alongside calendars, contacts, CalDAV sync with your phone, and CardDAV integration. If you used Horde before Plesk deprecated it, SOGo is the closest modern equivalent in terms of feature scope.
The honest caveat: SOGo has its own significant vulnerability history. In August 2026, SOGo released version 5.12.10 patching four serious flaws: a SQL injection, multiple XSS injections via malicious email, an SSRF, and a shell injection via the sendmail component. The sendmail issue was considered complex enough to fix properly that the team disabled sendmail support entirely in the patched version rather than ship a fix. SOGo v6 is being rebuilt from scratch on Next.js and Python. The team has effectively acknowledged the current architecture has structural limitations.
SOGo is worth running if you need its groupware features. Go in knowing it requires active maintenance and has had serious vulnerabilities patched as recently as this August. The security record is not as long as Roundcube’s but the August 2026 release showed that serious issues remain in the current codebase. Keep it updated.
At a Glance: Which Webmail Client for Your Setup
| Roundcube | SnappyMail | SOGo | |
|---|---|---|---|
| Database required | Yes | No | Yes |
| Calendar and contacts | Via plugin | No | Yes (native) |
| State-sponsored targeting | Yes (APT28) | No record | No record |
| CISA KEV listings | 11 previous CVEs (this one not yet listed) | 0 | 0 |
| Active maintenance | Yes | Yes | Yes |
| Available in Plesk | Yes | Yes (extension) | Yes |
| virtuser_query enabled by default | cPanel: Yes | N/A | N/A |
| Best for | Most users — keep updated | Basic email, lower attack surface | Full groupware needs |
What to Do Right Now
Check whether you use Roundcube. Log into webmail through your hosting control panel. Look for the Roundcube name and version number in the footer or under Settings. On cPanel, Roundcube is listed as one of the webmail client options in your dashboard. On Plesk, the active webmail client is visible under Mail settings.
Check your version. The minimum patched versions are 1.6.16 (1.6.x branch) and 1.7.1 (1.7.x branch), but the current latest releases are 1.6.19 and 1.7.4, which include 29 further security fixes shipped since May. Update to the latest available version for your branch, not just the minimum.. If you are on Plesk with auto-updates enabled, check your installed version to confirm the update landed in May. If you are on managed shared hosting, ask your host directly.
If you cannot update immediately, disable or remove the virtuser_query plugin. This eliminates the specific attack vector for CVE-2026-48842 without taking webmail offline.
Review your patching process for bundled packages. Roundcube is not the only software that ships pre-installed with your control panel and then gets forgotten. If your process for updating WordPress plugins and themes is more reliable than your process for updating webmail software, change that. The security of your email infrastructure is worth the same attention as your website.
Common Questions About Roundcube CVE-2026-48842
What is Roundcube?
Roundcube is the most widely deployed open source webmail client in the world. It is the browser-based interface that lets you read and send email through your hosting control panel without setting up a dedicated email application. It is installed with cPanel by default and available as a bundled package in Plesk, DirectAdmin, and most other hosting control panels.
Am I affected by CVE-2026-48842?
You are potentially affected if you run Roundcube below version 1.6.16 or 1.7.1 and the virtuser_query plugin is active. If you are on managed shared hosting with a reputable provider, your host should have applied the patch in May. If you run Plesk with auto-updates enabled, the update almost certainly landed automatically. If you manage a self-hosted server with Roundcube installed manually, check your version now.
Does this affect Plesk as well as cPanel?
Less so than cPanel. Plesk does not enable the virtuser_query plugin in its Roundcube bundle, which means the specific attack vector for CVE-2026-48842 is not present in a standard Plesk setup. On top of that, Plesk shipped the patched Roundcube version (1.6.16) in May via its standard update mechanism. If your Plesk server is on auto-updates, you are protected on both counts. cPanel servers are the higher-risk group here. The virtuser_query plugin is active by default in many cPanel Roundcube configurations, and patching depends entirely on whether the host applied the May update.
How do I check my Roundcube version?
Log into webmail through your control panel and look for the version number in the footer of the interface or under Settings. On Plesk servers, the installed version of Roundcube is also visible in the Plesk panel under Mail settings. The patched versions are 1.6.16 and above on the 1.6.x branch, or 1.7.1 and above on the 1.7.x branch.
What should I do if I cannot update Roundcube immediately?
Disable or remove the virtuser_query plugin from your Roundcube installation. The virtuser_query plugin is the specific component containing the SQL injection flaw. Removing it eliminates the attack vector for CVE-2026-48842 without taking webmail offline entirely. Update to a patched version as soon as possible after applying this interim step.
Is SnappyMail safer than Roundcube?
SnappyMail has a smaller attack surface in one significant respect: it does not require a database. CVE-2026-48842 exploited Roundcube’s database layer directly, so a webmail client without a database removes that entire category of risk. SnappyMail also has no history of CISA KEV listings or state sponsored targeting. The tradeoff is that it does not include calendar or contacts functionality. For basic email use, it is a cleaner option from a security standpoint. Keeping a current Roundcube installation is still a reasonable choice. The key word is current.
What happened to RainLoop?
RainLoop was abandoned by its original developer in 2022 and has received no security updates since. Running RainLoop in 2026 means running an unmaintained webmail client that parses untrusted HTML email from strangers. SnappyMail is the maintained fork that took over the RainLoop codebase. If you are still on RainLoop, migrating to SnappyMail is not optional. It is overdue.
