Rejetto HFS Vulnerability CVE-2026-61500 Draws Attacker Probes After Exploit Write-Up

Industry News  ·  October 7, 2026  ·  By Oreaxe Editorial Team

Attackers have started probing internet-facing Rejetto HTTP File Server (HFS) installations for CVE-2026-61500, a critical Rejetto HFS vulnerability that lets an unauthenticated attacker forge an administrator session and run code on the server. A fix has been available since version 3.2.1 in July, but a detailed public exploit write-up published on September 30, 2026 has put unpatched servers on attackers’ lists.

What happenedHoneypots recorded probes for CVE-2026-61500 days after a detailed exploit write-up went public
Who’s affectedRejetto HFS 3.0.0 through 3.2.0
SeverityCritical: CVSS 3.1: 9.8 and CVSS 4.0: 9.3 (VulnCheck, as CNA)
StatusPatched in HFS 3.2.1; probing observed, no confirmed successful compromise reported yet
What to do nowUpgrade to 3.2.1 or later and take HFS off the public internet if you don’t need it there

What happened

Decoy sensors run by VulnCheck picked up attempts against CVE-2026-61500, according to a LinkedIn post by the firm’s Caitlin Condon that BleepingComputer reported on October 5, 2026. Condon described it as small-scale reconnaissance from one IP address on China Telecom’s network, hitting sensors located in the United States and Japan. SecurityWeek dates VulnCheck’s warning to October 2, 2026.

The bug itself is not new. The NVD entry was published on July 13, 2026, and VulnCheck’s advisory lists HFS 3.0.0 through 3.2.0 as affected, with 3.2.1 as the fixed release. Rejetto’s own 3.2.1 release notes warn that all previous versions carried flaws that could give an attacker administrative access.

What changed is the level of detail in public. On September 30, 2026, Horizon3.ai published a step-by-step analysis of the exploit chain. Horizon3 says it found the Rejetto HFS vulnerability using Anthropic’s Mythos model; VulnCheck credits Horizon3’s Zach Hanley in collaboration with Claude and Anthropic Research.

How the Rejetto HFS vulnerability is exploited

HFS signs its session cookies with a secret key. In the affected versions that key is built from JavaScript’s Math.random(), which is a fast generator for things like shuffling, not a source of secrets. NVD tracks the weakness as CWE-338, use of a cryptographically weak pseudo-random number generator.

In our view, that alone would be hard to exploit. The second half of the problem is that HFS also hands out outputs of the same generator to anyone who starts a login with a valid username, no password needed. Horizon3’s write-up describes collecting 12 of those values from an unauthenticated endpoint, feeding them to the Z3 solver to rebuild the generator’s internal state (V8’s xorshift128+), then stepping backwards to recover the signing key created when the server started.

With the key in hand, the attacker forges a valid administrator session cookie. From there, the NVD description says, full administrative access leads to remote code execution through the server_code configuration feature, which lets an admin run custom server-side JavaScript. BleepingComputer lists the realistic outcomes: stealing or deleting hosted files, planting malware on the server, or using it as a foothold into the internal network.

Why it matters for small businesses

BleepingComputer describes HFS as a free, open-source tool for self-hosted file sharing on Windows, Linux and macOS. That makes it an easy quick fix for sharing large files with clients or between offices, and in our experience it is often set up by one person and then forgotten. We’d expect forgotten servers to be the most likely to miss a July patch.

A file server also tends to hold exactly what you don’t want leaked: contracts, scans of IDs, design files, payroll exports. If personal data sits on a compromised HFS box, breach notification duties may apply, under UK GDPR, EU GDPR or US state breach laws depending on where you operate and whose data it is.

Keep the current status in perspective. The probing so far is described as small-scale, and VulnCheck has not shared details of successful exploitation. In our view, that quiet period won’t last now that exploit details are public, which is why we’d act this week rather than next month.

What to do now

  1. Find every HFS instance. Ask whoever handles IT, and check for HFS processes on desktops and small servers, including that one machine in the corner someone set up for a client project.
  2. Upgrade to 3.2.1 or later. That closes the Rejetto HFS vulnerability. Get the release from the project’s official GitHub releases page and pick the newest stable build listed there.
  3. Remove public exposure. If clients don’t need direct internet access to the server, block it at the firewall and reach it over your existing remote-access setup instead.
  4. Assume compromise on exposed, unpatched servers. Review the HFS admin account and configuration for custom server code you didn’t add, check the host for new accounts or scheduled tasks, and rotate any credentials stored on that machine.
  5. Replace it if it was a stopgap. A managed file-sharing service with MFA and audit logs removes a server you have to patch yourself.

Oreaxe’s take

Like the Roundcube webmail flaw we covered this week, this is a bug in a self-hosted tool that small teams run and patch themselves. Here the fix shipped in July, and attacker interest showed up days after a public write-up made exploitation easier. In our view, the gap between “patch available” and “exploit details public” is the best head start you get. In our experience, small firms often waste it because nobody owns the inventory.

The cryptographic mistake here is worth a second look if you build anything in-house. Here a non-cryptographic random generator was used for session secrets, and Horizon3’s write-up shows the attack chain depends on the leaked generator output as well. If your developers sign cookies or tokens, check that keys come from a cryptographically secure source and are never exposed.

Our view on priorities is simple: inventory first, patch second, and take anything you don’t need off the internet. For a wider list of the risks worth planning for, see our small business cyber threats guide.

Sources

Every factual claim links to its source. Spotted an error? Tell us.

OT
Written byOreaxe Editorial TeamMore from Oreaxe Editorial Team →
Scroll to Top