cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Rejetto HFS Servers Face Active Scanning for Critical RCE Vulnerability

· Original article ↗

Summary

Rejetto HFS servers are being probed for CVE-2026-61500, a flaw that can enable session forgery, account takeover, and remote code execution. No successful exploitation has been reported; users should upgrade.

Key points

  • VulnCheck honeypots observed small-scale probes targeting CVE-2026-61500 from a single China Telecom IP, probing deployments in Japan and the United States.
  • The flaw affects Rejetto HFS versions 3.0.0 through 3.2.0: predictable Math.random() session-key generation and leaked generator outputs can let unauthenticated attackers forge administrator session cookies.
  • Attackers could use the forged access to execute server-side JavaScript and achieve remote code execution.
  • Horizon3 published technical details and a proof-of-concept exploit on September 30; the article says this may have prompted the scanning.
  • VulnCheck has not reported successful exploitation or post-exploitation activity.
  • The flaw is fixed in HFS 3.2.1; users are advised to upgrade, preferably to the latest stable release, 3.3.4.

Article Details

Vulnerability Types
  • Weak session-cookie signing key generation
  • Leakage of random-number generator outputs to unauthenticated clients
Severity
Critical
Affected Versions
  • Rejetto HFS 3.0.0 through 3.2.0
Exploitation Status
reported
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1059.007 · JavaScriptThe researchers' exploit uses HFS's built-in ability to execute custom server-side JavaScript to achieve remote code execution.T1606.001 · Web CookiesThe published exploit reconstructs the session-cookie signing key and forges a valid administrator session cookie.

CVE

CVE-2026-61500Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE).

People

Caitlin CondonVulnCheck VP of Security Research who reported honeypot probes targeting the vulnerability.

Vendors

AnthropicHorizon3 researchers discovered the flaw using Anthropic's Mythos model, which identified both the weak signing-key generation and the leak that enabled key recovery.RejettoRejetto HFS servers now actively scanned for critical RCE flaw

Products

MythosHorizon3 researchers discovered the flaw using Anthropic's Mythos model, which identified both the weak signing-key generation and the leak that enabled key recovery.Rejetto HFSRejetto HFS servers now actively scanned for critical RCE flaw

Countries

JapanCondon said the observed activity appears to be small-scale reconnaissance from a single China Telecom IP address probing deployments in Japan and the United States.United StatesCondon said the observed activity appears to be small-scale reconnaissance from a single China Telecom IP address probing deployments in Japan and the United States.

Related Articles