Critical-severity CVE-2026-42897 could lead to remote code execution, and hackers are already taking advantage.