Roundcube Webmail unauthenticated SQL injection vulnerability CVE-2026-48842 exploited in attacks

The Canadian Centre for Cyber Security warns that threat actors are exploiting the high-severity Roundcube Webmail vulnerability CVE-2026-48842 in attacks. The vulnerability enables unauthenticated SQL injection in the virtuser_query plugin.