cve-2026-48842

CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin bundled with Roundcube Webmail, affecting the 1.6.x branch before 1.6.16 and the 1.7.x branch before 1.7.1. Roundcube patched the flaw on May 24, 2026, and Canada's Canadian Centre for Cyber Security later added an active exploitation warning on September 21. Only servers with the plugin enabled are exposed, but that still leaves an unauthenticated route into the webmail database on many hosting servers. This tag collects WindowsForum coverage and discussion of the vulnerability, its patch timeline, and the risk to administrators who have not yet updated.