Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

A vulnerability in Roundcube Webmail is being actively exploited, according to a warning from the Canadian Centre for Cyber Security. The issue is a pre-authentication SQL injection flaw in the virtuser_query plugin, identified as CVE-2026-48842 with a CVSS score of 8.1. This vulnerability affects Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The problem arises from a preg_replace() backslash issue. The vulnerability has been patched, but exploitation is ongoing.