Hackers now exploit critical Roundcube flaw in code injection attacks

A pre-authenticated SQL injection vulnerability in Roundcube Webmail (CVE-2026-48842) is being actively exploited despite a patch being available since May, highlighting the persistent danger of delayed patch adoption. Because the flaw requires no prior authentication, attackers can bypass login controls entirely, execute arbitrary database commands, and exfiltrate sensitive data at scale. The fact that exploitation is now widespread indicates that many administrators failed to apply the patch within an acceptable risk window. This case underscores that unpatched internet-facing applications — especially email platforms handling sensitive communications — represent a high-priority attack surface that adversaries actively monitor for newly disclosed vulnerabilities.