🔴 Critical: Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
-
A critical vulnerability in Rejetto HTTP File Server (HFS) is currently being targeted in active exploitation attempts, according to VulnCheck. The flaw, tracked as CVE-2026-61500, carries a CVSS score of 9.3, placing it in the critical severity range.
The issue is a case of session forgery caused by the use of a weak pseudo-random number generator (PRNG). Because the generator produces predictable values, an attacker can derive the key used for authentication, allowing them to forge an administrative session and gain unauthorized access to the server. Successful exploitation can ultimately lead to remote code execution.
Key points:
- Affected product: Rejetto HTTP File Server (HFS)
- Identifier: CVE-2026-61500
- Severity: CVSS 9.3 (critical)
- Root cause: weak pseudo-random number generator producing a predictable key
- Impact: admin session forgery, unauthorized access, and remote code execution
- Status: active exploitation attempts observed
Administrators running Rejetto HFS should treat this as urgent. Given the predictable-key nature of the flaw, simply changing passwords is not sufficient protection. Restricting network exposure of the service, monitoring for suspicious administrative sessions, and applying any vendor fixes or mitigations as soon as they are available are the priority steps.
Source: The Hacker News
Is your organization running Rejetto HFS, and if so, how are you handling exposure and mitigation?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login