Back Cybersecuritynews

Mail2Shell Zero

Cybersecuritynews •Abinaya • March 5, 2026

Researchers have uncovered a critical zero-click vulnerability in FreeScout, a widely used open-source help desk and shared mailbox application. Dubbed “Mail2Shell,” this flaw allows attackers to hijack mail servers without any user interaction or authentication. The vulnerability, tracked as CVE-2026-28289, bypasses a recently patched Remote Code Execution (RCE) flaw, escalating it into an unauthenticated zero-click […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FreeScout Vulnerability Enables Zero-Click RCE Attacks A critical vulnerability in FreeScout has been identified, allowing for zero-click remote code execution (RCE) attacks. This flaw escalates a previously disclosed authenticated code execution bug, enabling unauthenticated attacks that can compromise servers without user interaction. Affected systems are at risk of full server compromise due to this security issue. 8 sources 47

Extracted Entities

Mail2Shell Zero

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Vulnerabilities (1)