Roundcube Webmail Flaw: The NC Mailbox Nobody Patches

If you read one paragraph: Canada's national cyber agency updated an advisory on September 21, 2026 to relay open-source reporting that a pre-authentication flaw in Roundcube webmail, CVE-2026-48842, is being exploited. The fix shipped on May 24. The reason this reaches a plant in Thomasville or a distributor in Kernersville has less to do with the flaw than with a question somebody can answer today: is there still a mailbox on an old hosting plan nobody is watching? On shared hosting you cannot install the update yourself. Your host does it, or nobody does.

Updated October 23, 2026: Roundcube shipped 1.6.20 and 1.7.5 on October 19 with further security fixes; that is the version to ask your host about. As of October 23 this CVE is still not in CISA's KEV catalog.

Who this page is for: at any North Carolina company, whoever sees the card statement and whoever holds the domain registrar login. If that is not you, forward it with one question: do we still pay a hosting company?

Here is the email to send, because it should not be buried at the bottom:

Please confirm in writing: (1) the exact Roundcube version running on our account; (2) whether the virtuser_query plugin is in use on our account, and if it is and you have not yet applied the fix, whether you will disable it; (3) the date you applied the 1.6.16 or 1.7.1 security release and the October 19 release (1.6.20 or 1.7.5), or your planned dates, and if we are on a branch older than 1.6, whether it is still supported at all; (4) a list of the email addresses on our account showing which are mail accounts with logins and which are forwarders only; (5) whether webmail access can be restricted by IP or disabled entirely on our account; and (6) whether two-factor authentication is enabled for webmail logins on our account. Please reply within five business days. If the answer to (1) and (2) is that we are on 1.6.x before 1.6.16, or 1.7.x before 1.7.1, with virtuser_query in use, please do not hold that for the reply: disable the plugin or apply the release now, and tell us the same day what you have done.

Everything below is why that is the right email.

Do we even run Roundcube?

Probably, if the company website sits on a cPanel hosting plan, though the name may never have come up. cPanel's deprecation plan records that "Horde relies on PHP 7.4, which reached End-of-Life on November 28, 2022. Because of this, we have removed the Horde webmail interface," with calendars and contacts migrated to Roundcube automatically. Since that removal, webmail on a cPanel host means Roundcube.

So the shape of this in a Greensboro or High Point shop has nothing to do with choosing Roundcube. Somebody bought a hosting plan years ago with the website and unlimited mailboxes; the company later moved to Microsoft 365 and the named users went with it; the plan was never cancelled, because the website was still on it and info@, sales@ and accounting@ still forwarded from it.

On cPanel an address can be a forwarder, a routing rule with no mailbox and no login, or a mail account, a mailbox with a password that Roundcube serves. Only the account kind has a login of yours to land on. But the flaw is pre-authentication and lives in the server's plugin, so a forwarder-only customer on a vulnerable server still needs the host to fix it: the distinction changes what you can do, not whether you are exposed. Neither kind appears in the Microsoft 365 admin center.

This is a billing discovery, not a technical one. Look for a recurring charge to a hosting company, then check whose name is on the account. It may not be anyone still employed, which matters the first time you need the host to talk to you.

If nobody can say who owns the hosting account: we will inventory the mailboxes, domains and hosting plans the company pays for, including the ones nobody remembers, and hand back a one-page list with a name against each line. It needs some of your controller's time, more if several cards, entities or hosting vendors are in play. Preferred Data Corporation, High Point, North Carolina, (336) 886-3282.

Does the flaw hit every Roundcube install?

No, and this is where the coverage tends to overstate it. The CVE record describes "Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass," affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1. MITRE scores it 8.1, vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain terms: no login needed, no click needed, attack complexity rated high, confidentiality, integrity and availability all rated high. That is why a hard-to-exploit bug still scores 8.1, and when it lands, it lands on the mail database.

Two qualifications. It is scoped to a setting, not the product: the injection is in the virtuser_query plugin, so an install not using that lookup is not exposed through this door, and only your host can say which yours is. And the patch is old: the fix shipped on May 24, 2026 in 1.6.16 and 1.7.1, and current is 1.6.20 and 1.7.5, from October 19. Anything still vulnerable is five releases and five months behind, which makes this a question about who was watching the account.

How seriously should I take "actively exploited"?

Seriously, but read what was said. The Canadian Centre for Cyber Security's advisory AV26-503, updated September 21, 2026, puts it in one sentence: "Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild." That is a national cyber centre relaying third-party reporting rather than its own telemetry, and The Hacker News reported on September 25 that no further detail had been disclosed.

The nearest named observation came a day earlier: Greenbone reported on September 24 that Coalition had seen exploitation attempts against its honeypot - a cyber insurance carrier reporting its own honeypot, not an independent confirmation. Greenbone puts the EPSS score at 0.8 percent, and CISA's coordinator note inside the CVE record, dated September 24, rates Exploitation "none" and Automatable "no" while rating technical impact "total".

Three figures get misquoted. As of September 24, Shadowserver tracked over 523,000 Roundcube instances exposed to the internet, which is not a count of vulnerable ones: BleepingComputer notes there is no information on how many are honeypots or already patched. Ten were flagged vulnerable as of September 23, per Shadowserver via The Hacker News. And this CVE is not in CISA's KEV catalog, which does not mean Roundcube is untroubled: per the catalog's JSON feed on October 23, eleven Roundcube flaws sit in KEV, two added on February 20, 2026.

Ten flagged hosts is small. It is here for the pattern: this software has had flaws exploited repeatedly, it faces the public internet by design, and on a shared plan it arrives with the hosting rather than being chosen.

Why the standard advice fails on shared hosting

On a shared plan you do not control the Roundcube version; your host does. You can change a password, turn on a second factor, and ask. That is close to the end of your authority, which is why "update to 1.6.16 or later" tells a cPanel customer to do something they have no button for. The more useful second half is that disabling or removing the virtuser_query plugin removes the attack vector without an upgrade - a configuration change, so a reasonable thing to ask for.

One control you can act on yourself is missing from the advisories, because it is not about this CVE. cPanel supports two-factor authentication on individual webmail accounts, and its webmail settings documentation names the catch: "To use this feature, your hosting provider must enable two-factor authentication (2FA) in WHM's Two-Factor Authentication interface." Free. Look under Security in webmail; if it is not there, that is question six above.

If you have both halves of an email estate, are you managing both?

	Microsoft 365 mailbox	Mailbox on the old hosting plan
Who installs security updates	Microsoft, which runs the service's operating systems and hosts	Your hosting provider, on its schedule
Two-factor authentication	Available and enforceable centrally	Supported by cPanel, but only if your host enabled it and the mailbox owner turned it on
Appears in your provider's inventory	Check the tenant against the inventory	Ask to see the inventory, and ask whether one exists
Who notices a login from overseas	Alerting exists if configured	Nobody, unless somebody set up a watch
Who is accountable when it is breached	Under Microsoft's shared-responsibility model protecting your identities is your job	Read your hosting terms and find out

The last row is the one to check. Read the limitation-of-liability clause in your hosting agreement this month, not during an incident.

Want somebody else to read the hosting agreement and grade the host's reply? Send both over. Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265, (336) 886-3282.

What does an old mailbox have to do with money?

Look at the shared addresses as well as the personal ones: the address on the bottom of your invoices, and the one customers send RFQs and drawings to. Somebody reading it wants the pattern rather than the mail - your customers, your terms, your remittance instructions - and then one invoice goes out with changed bank details, inside a thread that already exists. The FBI's 2025 Internet Crime Report logged $3.046 billion in reported business email compromise losses for the year.

A quieter version needs no attacker. If a portal, an EDI notification or a supplier scorecard emails a shared address on that plan and it stops working, find out what would tell you: a bounce somebody reads, an alert from the portal or VAN, or nothing. The third surfaces later as a delivery-performance ding.

What to do this week

Find out whether a hosting plan still exists. If you see the card statement, look for a recurring charge to a hosting company. If you do not, step one is an email to the person who does: do we still pay a hosting company, and who is the account contact?
List every address that is not in Microsoft 365. The addresses on your invoices, quotes, packing slips, website and signage, plus any address a customer portal or carrier notifies. Anything that does not resolve to a named person in your tenant is the list.
Send your host the email at the top of this page. A written question creates a record.
Turn on two-factor authentication in webmail on every legacy mailbox you can get into. Security, Two-Factor Authentication, scan the code. Free, and no downtime. One caution, and it is the shared addresses this post is about: whoever scans the code owns the account, so on any mailbox two or three people open, settle first who holds the enrolment and how a second person gets in.
Change the password on any mail account you can get into, once you know what logs into it. Two cautions. A forwarder does not exempt you: the flaw is pre-authentication and sits in the server's plugin, so it needs no mailbox of yours. That split decides whether you have a password to rotate, not whether you are exposed. And a rotation is not invisible: forwarding keeps working, but anything that logs in stops - Outlook or a phone on the mailbox, a POP or IMAP collector feeding Microsoft 365, the website contact form, the copier if yours emails scans to the office. List what authenticates as that address first, with the new password ready for each.
Then decide whether the mailbox should exist at all. Most should become a forward or shared mailbox inside Microsoft 365, behind the same second factor. Deleting breaks delivery, so find out where the address is published, redirect first, verify for a month, then remove.

Grade the reply like a certificate of analysis: if there is no version number in it, nobody looked.

Frequently Asked Questions

We moved to Microsoft 365 years ago. Is any of this ours?

Possibly. The test is not what you migrated but what you cancelled: if the plan is still being paid for, whatever was configured on it probably still is. Check the statement, then ask the host.

Is Roundcube insecure software we should avoid?

Wrong frame. It is widely used open-source webmail with a working security process: the May 24 release fixed eight issues. The gap is between a patch existing and a patch reaching your account.

Our customer portal and EDI notifications go to a shared address. Same problem?

Yes, and a quieter one. Test it: does a failed send bounce an NDR anybody reads, and does the portal, VAN or ERP raise anything when a document does not arrive? Where the answer is no on both, you find out when the other party tells you.

Does our cyber insurance care about this?

Read the application you signed. If it asked whether multifactor authentication is enforced on email, a wrong answer is the kind of detail examined at claim time. Your broker confirms how your carrier treats it.

Is this urgent enough to interrupt a production week?

That depends on an answer you do not have yet, so split it.

While you do not know whether you are exposed: no. One carrier's honeypot, an unattributed "open-source reporting" line and an EPSS of 0.8 percent are not an emergency, and steps one through four need no downtime. Do them now rather than in the spring, because the next advisory lands on the same unowned account.

If your host confirms 1.6.x before 1.6.16, or 1.7.x before 1.7.1, with virtuser_query in use: the five-business-day window no longer applies. That is a remotely reachable flaw needing no login, rated high across confidentiality, integrity and availability, on a component a national cyber centre says is reported exploited. Ask that day, in writing, for the plugin to be disabled or the release applied. The calm version of this page is for readers who do not yet know; it is not advice to sit on a confirmed exposure.

Monday morning: find out whether a hosting company is still being paid, and put one name against that account.

If the answer is nobody, we can take it off your desk. Preferred Data Corporation, headquartered in High Point, NC since 1987, on site within 200 miles and remote across the US and worldwide. Call (336) 886-3282.