A critical vulnerability in the FreeScout open-source helpdesk platform allows attackers to achieve unauthenticated remote code execution (RCE) by sending a specially crafted email attachment to a FreeScout mailbox. The flaw, tracked as CVE-2026-28289, bypasses a recent fix for another RCE vulnerability (CVE-2026-27636) by inserting a zero-width space (Unicode U+200B) before a malicious filename, evading validation checks designed to block dangerous file uploads. During processing, the invisible character is removed, allowing the file to be stored as a dotfile and enabling execution through the web interface. Because FreeScout automatically processes inbound email attachments and stores them in a web-accessible directory, exploitation requires no user interaction, effectively making it a zero-click attack that could lead to full server compromise, data theft, lateral movement, or service disruption. The issue affects FreeScout versions up to 1.8.206 and has been patched in version 1.8.207. Security researchers identified over 1,100 publicly exposed instances of the platform, highlighting the potential impact. Although no active exploitation has been observed yet, CTIX analysts strongly advise any affected readers to patch immediately and consider additional mitigations such as disabling AllowOverrideAll in Apache configurations.