The issue is a case of session forgery caused by the use of a weak pseudo-random number generator (PRNG). Because the generator produces predictable values, an attacker can derive the key used for authentication, allowing them to forge an administrative session and gain unauthorized access to the server. Successful exploitation can ultimately lead to remote code execution.

Key points:

• Affected product: Rejetto HTTP File Server (HFS)
• Identifier: CVE-2026-61500
• Severity: CVSS 9.3 (critical)
• Root cause: weak pseudo-random number generator producing a predictable key
• Impact: admin session forgery, unauthorized access, and remote code execution
• Status: active exploitation attempts observed

Administrators running Rejetto HFS should treat this as urgent. Given the predictable-key nature of the flaw, simply changing passwords is not sufficient protection. Restricting network exposure of the service, monitoring for suspicious administrative sessions, and applying any vendor fixes or mitigations as soon as they are available are the priority steps.

Source: The Hacker News

Is your organization running Rejetto HFS, and if so, how are you handling exposure and mitigation?