FreeScout CVE-2026-40498

Requires the FreeScout instance to be accessible over a network (typically internet-facing on standard HTTP/HTTPS ports 80/443). No authentication, credentials, or user interaction required - the vulnerability exists in default configurations. Exploitation is possible against any FreeScout installation prior to version 1.8.213 where the /system/cron endpoint responds to external requests. Installations behind reverse proxies or web application firewalls that block /system/* paths are protected. Rate limiting at the infrastructure level (CDN, load balancer) may mitigate denial-of-service impact but does not prevent information disclosure. The attack does not require insider knowledge beyond identifying the target as a FreeScout instance, which is easily fingerprinted via HTTP headers or login page characteristics.

Real-world risk is HIGH despite CVSS 8.9 appearing moderate for critical infrastructure. The CVSS 4.0 vector confirms worst-case exposure: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), with high confidentiality and integrity impacts (VC:H/VI:H). The E:P (Proof-of-concept) exploit status indicates working attack code exists, dramatically reducing attacker effort. However, exploitation requires the FreeScout instance to be internet-facing - internal deployments behind authentication proxies have substantially lower risk. The lack of EPSS scoring prevents quantitative exploitation probability assessment, but the combination of unauthenticated network access, confirmed POC, and straightforward attack path suggests active scanning is likely. The primary risk drivers are information disclosure enabling further attacks (exposed server paths aid in chaining exploits) and availability impact from resource exhaustion. CRITICAL MISSING DATA: No CISA KEV listing despite POC availability suggests exploitation is not yet widespread, but targeted attacks against help desk systems containing customer data are plausible. Defenders should prioritize based on internet exposure and sensitivity of ticket data.

An attacker performs reconnaissance by accessing the /system/cron endpoint without credentials, receiving the predictable MD5 hash in the response. Using the exposed hash, the attacker repeatedly triggers resource-intensive background tasks (email processing, database maintenance) by replaying requests to the diagnostic endpoints, causing CPU and memory exhaustion that degrades service availability. Simultaneously, the attacker harvests full filesystem paths and process IDs from diagnostic output to map the server environment for subsequent attacks, such as local file inclusion exploits targeting the now-known application directory structure.