Roundcube Webmail Vulnerability in Attackers’ Crosshairs

A critical unauthenticated SQL injection vulnerability (CVE-2026-48842) in Roundcube Webmail's virtuser_query plugin is being actively exploited in the wild, allowing attackers to manipulate database operations and access sensitive user data without any credentials. The unauthenticated nature of this flaw makes it especially dangerous, as it dramatically lowers the barrier for exploitation — no account takeover or phishing step is required. Organizations running unpatched Roundcube instances are directly exposing email authentication workflows and potentially all stored user data to threat actors. This incident underscores the critical importance of timely patch application for internet-facing services, where the window between vulnerability disclosure and active exploitation is increasingly narrow.