Critical FreeScout Bug Allows Zero-Click Server Takeover

Critical FreeScout vulnerability (CVE-2026-28289) allows zero-click server compromise; update to version 1.8.207 immediately.

By Content Team

Mar 5, 2026

ON THIS PAGE

A critical vulnerability in FreeScout help desk software (CVE-2026-28289) lets attackers completely compromise servers without any user interaction. The flaw bypasses a recent security patch using an invisible zero-width space character in filenames, allowing hackers to upload malicious .htaccess files simply by sending an email to any FreeScout mailbox.

Rated 10/10 on the severity scale, this zero-click remote code execution attack affects all FreeScout 1.8.206 installations running on Apache servers. Successful exploitation gives attackers full server control, access to helpdesk tickets and emails, plus potential network access for further attacks. Users should immediately update to version 1.8.207.

Source: Security Week

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?