ROUNDCUBE WEBMAIL SQL INJECTION VULNERABILITY CVE-2026-48842 UNDER ACTIVE EXPLOITATION

Summary from the TLDR InfoSec newsletter

Unauthenticated attackers are actively exploiting a pre-authentication SQL injection vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 to execute arbitrary database commands and access sensitive data. The flaw, tracked as CVE-2026-48842, resides in the built-in virtuser_query plugin. Administrators must immediately update to versions 1.6.16 or 1.7.1, or disable the vulnerable plugin.