Loading story…
FreeScout disclosed a maximum-severity remote code execution vulnerability, CVE-2026-28289, that enables a zero-click compromise of FreeScout mail servers by sending a single crafted email with a malicious attachment to any mailbox configured in the platform. The issue is a patch bypass of an earlier RCE, CVE-2026-27636, where filename validation intended to block dangerous uploads can be evaded by prefixing the filename with a zero-width space (U+200B), allowing the attachment to be stored and later processed in a way that results in code execution (e.g., via a malicious .htaccess).
Technical details indicate the weakness resides in sanitizeUploadedFileName() (app/Http/Helper.php) and is characterized as a TOCTOU logic flaw: the dot-prefix/extension checks occur before sanitization removes invisible characters, enabling restricted filenames to pass validation and later be interpreted as dotfiles after normalization. The attachment is stored under /storage/attachment/... and can be reached through the web interface, enabling unauthenticated exploitation in the email-delivery scenario; the vendor fix is available in FreeScout 1.8.207, and the vulnerability is scored CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with CWE-434 (unrestricted upload).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A Rapid7 Metasploit Framework pull request was opened to add a FreeScout zero-width-space .htaccess RCE module for CVE-2026-28289. This indicated public exploit tooling development for the vulnerability.
OX Security reported that the patch bypass could be exploited as an unauthenticated, zero-click RCE by sending a crafted email with a malicious attachment to a FreeScout-connected mailbox. The researchers said the attachment could be written to a predictable web-accessible location, enabling server compromise without user interaction.
CVE-2026-28289 was published describing a vulnerability affecting FreeScout 1.8.206 and earlier, where a zero-width space character could bypass filename security checks and lead to remote code execution. The advisory linked the issue to unrestricted dangerous file upload behavior and identified 1.8.207 as the fixed version.
FreeScout patched a bypass of its earlier upload protections in version 1.8.207. The fix addressed a TOCTOU issue in filename sanitization that let attackers use a zero-width space prefix to smuggle dangerous filenames such as .htaccess.
An earlier FreeScout vulnerability, CVE-2026-27636, allowed authenticated remote code execution by abusing draft-email attachment uploads to overwrite .htaccess and execute attacker-controlled PHP. FreeScout issued an initial patch intended to block dangerous extensions and dotfiles, but that fix was later found to be incomplete.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreeScout disclosed two high-severity vulnerabilities affecting versions prior to **1.8.206** that can be exploited independently or chained: **CVE-2026-27637** (predictable authentication token) and **CVE-2026-27636** (unsafe file upload restrictions enabling Apache configuration abuse). CVE-2026-27637 stems from *TokenAuth* generating a static token as `MD5(user_id + created_at + APP_KEY)`; if an attacker obtains the Laravel `APP_KEY` (a commonly exposed secret in misconfigured deployments), they can compute valid tokens for arbitrary users, including administrators, resulting in **account takeover without a password**. CVE-2026-27636 is caused by FreeScout’s upload restriction list not blocking `.htaccess` and `.user.ini`; on Apache servers configured with `AllowOverride All`, an authenticated user can upload a `.htaccess` file to alter how files are processed and achieve **remote code execution**. Belgium’s CCB/Safeonweb urged immediate patching and noted no confirmed active exploitation as of **25 Feb 2026**, while emphasizing that help desk platforms often contain sensitive customer data and can be leveraged for lateral movement. FreeScout fixed both issues in **1.8.206** via upstream commits and published GitHub security advisories for each CVE.
Jun 29, 2026
A critical SmarterTools *SmarterMail* vulnerability, **CVE-2025-52691**, enables **remote code execution (RCE)** via an **unauthenticated arbitrary file upload** condition (CWE-434). The issue affects SmarterMail **Build 9406 and earlier** and is fixed in **Build 9413 and later**; the NVD lists a **CVSS v3.1 score of 10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation can allow full server compromise, including webshell deployment, data theft, and lateral movement under the service’s privileges. Internet-wide scanning reported **8,001 likely vulnerable IPs** out of **18,783** exposed SmarterMail instances (about **42.6%** failing checks), with the largest concentration in the **United States (~5,000)** followed by the **UK** and **Malaysia**. **Public proof-of-concept exploit code** is available, increasing the likelihood of opportunistic exploitation against unpatched, internet-facing deployments; multiple national agencies reportedly issued advisories following disclosure in late December 2025.
Jun 29, 2026
A critical vulnerability identified as CVE-2025-52691 has been discovered in SmarterMail, allowing unauthenticated attackers to upload arbitrary files to any location on the mail server. This flaw, rated with a CVSS score of 10, enables remote code execution, potentially giving attackers full control over affected servers. The vulnerability can be exploited without authentication, significantly increasing the risk of compromise for organizations running vulnerable versions of SmarterMail. Security advisories emphasize the severity of this issue, warning that successful exploitation could lead to the deployment of web shells or other malicious payloads, facilitating further attacks or persistent access. Organizations using SmarterMail are urged to apply available patches immediately and review server logs for signs of unauthorized file uploads or suspicious activity.
Jun 29, 2026