Loading story…
FreeScout disclosed two high-severity vulnerabilities affecting versions prior to 1.8.206 that can be exploited independently or chained: CVE-2026-27637 (predictable authentication token) and CVE-2026-27636 (unsafe file upload restrictions enabling Apache configuration abuse). CVE-2026-27637 stems from TokenAuth generating a static token as MD5(user_id + created_at + APP_KEY); if an attacker obtains the Laravel APP_KEY (a commonly exposed secret in misconfigured deployments), they can compute valid tokens for arbitrary users, including administrators, resulting in account takeover without a password.
CVE-2026-27636 is caused by FreeScout’s upload restriction list not blocking .htaccess and .user.ini; on Apache servers configured with AllowOverride All, an authenticated user can upload a .htaccess file to alter how files are processed and achieve remote code execution. Belgium’s CCB/Safeonweb urged immediate patching and noted no confirmed active exploitation as of 25 Feb 2026, while emphasizing that help desk platforms often contain sensitive customer data and can be leveraged for lateral movement. FreeScout fixed both issues in 1.8.206 via upstream commits and published GitHub security advisories for each CVE.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity Belgium published an advisory warning that critical FreeScout vulnerabilities could be exploited to achieve remote code execution and urged immediate patching. The advisory reflects official government-level notification of the risk.
Two critical FreeScout vulnerabilities were publicly disclosed: CVE-2026-27636, involving upload of .htaccess or .user.ini files that can lead to remote code execution on Apache with AllowOverride enabled, and CVE-2026-27637, involving predictable static authentication tokens that can enable takeover of arbitrary accounts if the Laravel APP_KEY is known. The disclosures note the flaws can also be chained together.
FreeScout version 1.8.206 was released to remediate two vulnerabilities: an unrestricted dangerous file upload issue enabling Apache-based remote code execution and a predictable authentication token flaw enabling account takeover. The fixes address versions prior to 1.8.206.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceccb.belgium.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**FreeScout** disclosed a maximum-severity remote code execution vulnerability, **CVE-2026-28289**, that enables a *zero-click* compromise of FreeScout mail servers by sending a single crafted email with a malicious attachment to any mailbox configured in the platform. The issue is a **patch bypass** of an earlier RCE, **CVE-2026-27636**, where filename validation intended to block dangerous uploads can be evaded by prefixing the filename with a **zero-width space** (`U+200B`), allowing the attachment to be stored and later processed in a way that results in code execution (e.g., via a malicious `.htaccess`). Technical details indicate the weakness resides in `sanitizeUploadedFileName()` (`app/Http/Helper.php`) and is characterized as a **TOCTOU** logic flaw: the dot-prefix/extension checks occur before sanitization removes invisible characters, enabling restricted filenames to pass validation and later be interpreted as dotfiles after normalization. The attachment is stored under `/storage/attachment/...` and can be reached through the web interface, enabling unauthenticated exploitation in the email-delivery scenario; the vendor fix is available in **FreeScout 1.8.207**, and the vulnerability is scored **CVSS v3.1 10.0** (`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`) with **CWE-434** (unrestricted upload).
Jun 29, 2026
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026