Mail2Shell Zero-Click Attack lets Hackers Hijack FreeScout Mail Servers
## Cybersecurity: Critical Vulnerability in FreeScout
Cybersecurity: Critical Vulnerability in FreeScout
A critical zero-click vulnerability has been identified in FreeScout, an open-source help desk and shared mailbox application. This vulnerability, referred to as "Mail2Shell," allows unauthorized access to mail servers without user interaction or authentication.
The vulnerability, tracked as CVE-2026-28289, circumvents a recent Remote Code Execution (RCE) patch, escalating it into an unauthenticated zero-click attack. Security experts discovered a method to bypass an incomplete fix shortly after FreeScout addressed an authenticated RCE vulnerability (CVE-2026-27636).
Initially, the patch was designed to prevent dangerous file uploads by appending an underscore to files with restricted extensions or names that begin with a period. However, this security measure can be bypassed by appending a Zero-Width Space character (Unicode U+200B) to the malicious filename, as this character is not treated as visible content during security checks.
A critical zero-click vulnerability has been identified in FreeScout, an open-source help desk and shared mailbox application.
Once the file passes the initial check, the server removes the U+200B character, resulting in a dangerous file. Attackers can then send a crafted email with the malicious payload to any address on a FreeScout server, allowing the file to be automatically saved in a predictable directory. This enables attackers to execute remote commands via the web interface without authentication or user interaction.
FreeScout is widely used in public health, financial, and technology sectors for managing customer support. Built on the Laravel PHP framework, it has over 1,100 publicly exposed instances, making it a significant target for cyber threats. If exploited, the Mail2Shell vulnerability could lead to complete server takeover, data exfiltration, and lateral movement across networks.
FreeScout maintainers have released version 1.8.207 to address this vulnerability. Administrators are advised to apply this update immediately, as previous patches do not protect against this zero-click escalation.
Based on reporting by Cyber Security News.