Attackers Probe Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Summary
VulnCheck detected limited probing of Rejetto HFS systems exploiting CVE-2026-61500, a critical session-forgery flaw that can enable administrator access and remote code execution. HFS 3.2.1 includes a patch.
Key points
- CVE-2026-61500 affects Rejetto HFS versions 3.0.0 through 3.2.0 and has a CVSS score of 9.3.
- The flaw stems from using Math.random() for session-cookie signing keys while exposing outputs from the same PRNG to unauthenticated clients.
- An attacker can reconstruct the PRNG state, forge an administrator session cookie, and use the server_code feature to execute JavaScript remotely.
- Rejetto released a fix in version 3.2.1 in July 2026.
- A Python proof-of-concept exploit became public in late September 2026.
- VulnCheck detected exploitation attempts on October 1, describing the activity as small-scale reconnaissance against vulnerable hosts in the U.S. and Japan.
Article Details
- Vulnerability Types
- Session forgery due to a weak pseudo-random number generator
- Authentication bypass
- Remote code execution
- Severity
- Critical (CVSS 9.3)
- Affected Versions
- Rejetto HFS 3.0.0 through 3.2.0
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2024-23692CVE-2026-61500 is the second vulnerability in Rejetto HTTP File Server after CVE-2024-23692 (CVSS score: 9.8) to come under active exploitation in the wild. In July 2024, multiple threat actors were observed weaponizingCVE-2026-61500The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker
People
Alejandro RamosSecurity researcher who publicly released a Python-based proof-of-concept exploit; also identified as aramosf.Caitlin CondonVulnCheck vice president of research who described the observed activity as small-scale reconnaissance.Patrick GarrityVulnCheck source quoted about detecting exploitation attempts.Zach HanleyHorizon3.ai researcher who described the vulnerability and its path to remote code execution.
Malware
Vendors
Products
MythosHorizon3.ai researcher Zach Hanley, in a post published on September 30, 2026, said Anthropic's Mythos model was used to discover the vulnerability, describing it as an authentication bypass that facilitates arbitraryRejetto HTTP File Server (HFS)A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck.
Countries
Chinaadditional details of the flaw. The cybersecurity company said it identified an unnamed threat actor in China targeting real vulnerable hosts in the U.S.Japanlooks to be small-scale reconnaissance only, with a single China Telecom IP probing Canary deployments in Japan and the United States," Caitlin Condon, vice president of research at VulnCheck, said in a LinkedIn post.United Statesreconnaissance only, with a single China Telecom IP probing Canary deployments in Japan and the United States," Caitlin Condon, vice president of research at VulnCheck, said in a LinkedIn post.