Hackers Exploit Roundcube Webmail SQL Injection Flaw Without Authentication

Threat actors are actively exploiting a critical SQL injection vulnerability in Roundcube Webmail that can be triggered without authentication. Tracked as CVE-2026-48842, the flaw affects Roundcube Webmail versions earlier than 1.6.16 and 1.7.1. The Canadian Center for Cyber Security confirmed that open-source reporting has identified exploitation in the wild, elevating the urgency for organizations that use Roundcube as an internet-facing email platform. Hackers Exploit…