Exploitation of Rejetto HFS Flaw CVE-2026-61500 Begins

Executive Summary

A critical vulnerability in the Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, is under active exploitation by threat actors. The vulnerability, which has a CVSS score of 9.3, allows an unauthenticated remote attacker to achieve remote code execution (RCE). The flaw is due to the use of a weak, predictable random number generator (Math.random()) for creating the session cookie signing key. Attackers can reverse-engineer this key, forge an administrator cookie, and take complete control of the server. Security researchers have observed exploitation attempts targeting vulnerable HFS instances, prompting an urgent call for users to update to the patched version, HFS 3.2.1.

Vulnerability Details

CVE-2026-61500 is a session forgery vulnerability that leads to RCE. The root cause is a cryptographic weakness in how HFS generates its secret key for signing session cookies. The server uses Math.random(), a non-cryptographically secure pseudo-random number generator (PRNG), to seed this key.

The attack proceeds as follows:

1. Information Leak: The HFS login page inadvertently leaks outputs from the same Math.random() generator to unauthenticated clients.
2. State Reconstruction: An attacker can make a small number of requests to the login page to collect these random numbers. Because the PRNG is weak, this is enough information to reconstruct the internal state of the generator.
3. Key Recovery: Once the generator's state is known, the attacker can predict its future outputs, including the secret value used to sign session cookies.
4. Cookie Forgery: With the secret key, the attacker can now forge a valid session cookie for the admin user.
5. Remote Code Execution: The attacker uses their forged admin session to access the server's administrative panel and leverages the server_code feature to execute arbitrary commands on the underlying server.

Affected Systems

• Rejetto HFS versions 3.0.0 through 3.2.0 are vulnerable. The patched version is Rejetto HFS 3.2.1, released on July 13, 2026.

Exploitation Status

Active exploitation began shortly after technical details and a proof-of-concept were published by security researchers. The security firm VulnCheck, which discovered the flaw, has confirmed observing a threat actor based in China actively scanning for and exploiting vulnerable HFS servers, with targets identified in the United States. This indicates that any unpatched, internet-facing HFS instance is at high and immediate risk of compromise.

Impact Assessment

The impact of this vulnerability is critical. Successful exploitation gives an attacker full administrative control over the HFS server, which translates to RCE on the host operating system. An attacker can steal all files hosted on the server, modify server content, or use the compromised server as a pivot point to attack the internal network. Given that HFS is often used for simple file sharing, it may be deployed in less-secure environments without robust monitoring, making it an attractive target for attackers looking for an easy foothold. Compromised servers could be co-opted into botnets, used to host malware, or serve as a launchpad for ransomware attacks.

IOCs — Directly from Articles

No specific IOCs were provided in the source articles.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable systems or exploitation attempts:

Detection & Response

1. Version Scanning: Use vulnerability scanners or asset inventory tools to identify all instances of Rejetto HFS in your environment and check if they are running a vulnerable version (3.0.0 to 3.2.0).
2. Log Analysis: Analyze HFS and web server logs for rapid, repeated requests to the login page from a single IP address, which is a key indicator of the initial information gathering phase of the attack. D3-WSAA: Web Session Activity Analysis
3. Process Monitoring: Monitor the HFS server for any suspicious child processes. The HFS process should not normally be spawning command shells (cmd.exe, powershell.exe, sh). D3-PA: Process Analysis

Remediation Steps

1. Update Immediately: The primary and most urgent action is to update all Rejetto HFS instances to version 3.2.1 or later. This version replaces the weak PRNG with a cryptographically secure one, fully remediating the vulnerability. M1051 - Update Software
2. Restrict Access: If an immediate update is not possible, restrict access to the HFS server to trusted IP addresses only. Do not expose HFS servers to the public internet unless absolutely necessary. M1035 - Limit Access to Resource Over Network
3. Assume Compromise: If you find a vulnerable, internet-facing HFS server, assume it has been compromised. Isolate the server from the network and conduct a full forensic investigation to look for signs of persistence, malware, or lateral movement.