Roundcube SQLi (CVE-2026-48842) Exploited

A pre-authentication SQL injection in Roundcube's virtuser_query plugin (CVE-2026-48842, CVSS 8.1) — fixed in Roundcube 1.6.16 and 1.7.1 — is reported to be exploited in the wild; successful exploitation can allow unauthorized SQL operations with the database account's privileges. The advisory details affected versions (1.6.x before 1.6.16 and 1.7.x before 1.7.1), notes the plugin must be enabled to be exploitable, and recommends upgrading, validating plugin usage, tightening DB permissions, and hunting logs for suspicious unauthenticated activity.