The Canadian Centre for Cyber Security has warned of active exploitation of CVE-2026-48842, a pre-authentication SQL injection vulnerability in the virtuser_query plugin of Roundcube Webmail. This flaw affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, stemming from a preg_replace() backslash issue. Organizations using vulnerable Roundcube versions should apply the available patches promptly to prevent unauthorized access and data compromise.