Vulnerabilities · 239 days ago

Critical FreeScout flaw enables zero-click server compromise

The bug bypasses a prior fix for CVE-2026-27636 by using a zero-width space to save a .htaccess dotfile, creating a TOCTOU filename-sanitization bypass and enabling unauthenticated RCE.

CVE-2026-28289

NVD KEV

CVSS 10 CRITICAL: freeScout is a free help desk and shared inbox built with PHP's Laravel framework. EPSS 35% (98th percentile).

CVE-2026-27636

NVD KEV

CVSS 8.8 HIGH: freeScout is a free help desk and shared inbox built with PHP's Laravel framework. EPSS 2% (83rd percentile).

Timeline

Mar 5 Reported by Help Net Security
Mar 4 Reported by BleepingComputer

Sources

4 sources covering this story

Help Net Security Mar 5
FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) - Help Net Security
An authenticated RCE vulnerability (CVE-2026-28289) in FreeScout can be triggered by sending a specially crafted email to a FreeScout mailbox.
Infosecurity Magazine Mar 5
Zero-Click FreeScout Bug Enables Remote Code Execution
Ox Security warns that Mail2Shell could enable threat actors to hijack FreeScout systems without user interaction
BleepingComputer Mar 4
Mail2Shell zero-click attack lets hackers hijack FreeScout mail servers
A maximum severity vulnerability in the FreeScout helpdesk platform allows hackers to achieve remote code execution without any user interaction or authentication.
SecurityWeek Mar 4
Critical FreeScout Vulnerability Leads to Full Server Compromise
A patch bypass for an authenticated code execution bug, the flaw leads to zero-click remote code execution attacks.

Entities

CVE-2026-28289
CVE-2026-27636

Part of the PlainSec briefing for 2026-03-06