Attackers are scanning for a critical Rejetto HFS vulnerability that could let them forge administrator sessions and execute code remotely. Security researchers have detected probes targeting the flaw, although they have not disclosed successful compromises.
Tracked as CVE-2026-61500, the weakness affects Rejetto HFS versions 3.0.0 through 3.2.0. The open-source HTTP File Server supports self-hosted file sharing on Windows, Linux and macOS.
Version 3.2.1 fixes the vulnerability. Users running affected releases should prioritize upgrading.
Honeypots Detect Probes Against Exposed Servers
VulnCheck’s Canary Intelligence honeypots detected activity targeting the flaw, according to the company’s vice president of security research, Caitlin Condon.
The observed traffic appeared to involve small-scale reconnaissance from a single IP address on China Telecom’s network. It targeted deployments in Japan and the United States.
However, the network associated with that address does not establish who operated the scans or where the attackers were located.
VulnCheck has not shared evidence of successful exploitation or subsequent activity on compromised servers. Consequently, the findings establish active probing rather than a confirmed campaign of server takeovers.
Weak Session Signing Could Allow Administrator Access
The Rejetto HFS vulnerability involves the way affected releases generate and protect session cookies.
HFS used JavaScript’s non-cryptographic Math.random() function to derive its session-cookie signing key. Meanwhile, a separate login process exposed outputs from the same generator to unauthenticated users.
Together, those weaknesses could let a remote attacker recover the signing key and create a valid administrator session cookie.
That forged session could grant full administrative access. From there, an attacker could abuse HFS’s built-in server-side code feature to execute commands through custom JavaScript.
The issue therefore extends beyond unauthorized access to shared files: it could compromise the server running the application.
Researchers Published Exploit Details in September
The vulnerability first appeared publicly on July 13, 2026. Horizon3 later published a technical analysis and proof-of-concept exploit on September 30.
According to the researchers, Anthropic’s Mythos model helped discover the flaw. It identified both the insecure random-number generation and the separate information leak, then connected them into a viable attack chain.
Horizon3’s demonstration showed how forged administrative access could lead to remote code execution through the application’s server-side JavaScript functionality.
The scanning followed the publication of those details. However, the available evidence does not establish that the disclosure directly prompted the observed probes.
Compromise Could Expose Files and Internal Systems
Successful exploitation could allow attackers to access, steal or delete files available through HFS. They could also install malware on the host.
Depending on the server’s permissions and network access, attackers might then use it to reach other internal systems.
These are potential consequences of exploitation, rather than outcomes VulnCheck has confirmed in the detected activity.
Administrators should upgrade affected installations to version 3.2.1 or later. The report identifies version 3.3.4 as the latest stable release at the time of publication.
0 responses to “Critical Rejetto HFS Vulnerability Draws Active Scanning”