🚨 Roundcube SQL injection flaw actively exploited months after patches were released The Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild. ⠀ Roundcube is an open-source webmail application that lets people access email through a browser. The flaw affects its virtuser_query plugin and allows SQL injection before authentication. ⠀ Key details: • CVSS score: 8.1 • No attacker credentials required • No user interaction required • Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 ⠀ Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting. The advisory does not identify the attackers, victims or scale of exploitation. ⠀ Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities. Source: https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503