Citrix Zero-Days and Kiteworks Emergency Shutdown

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

The Canadian Centre for Cyber Security warns that a pre-authentication SQL injection vulnerability in Roundcube Webmail (CVE-2026-48842) is being actively exploited. The flaw exists in the virtuser_query plugin and affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Attackers can exploit this to gain unauthorised access to mail servers without needing valid credentials.