VulnCheck Reports Attempts to Exploit CVE-2026-61500 in Rejetto HFS
Security firm VulnCheck has recorded attempts to exploit a flaw in Rejetto HFS 3.x that could allow an attacker to forge an administrator session and execute code on the server.
CVE-2026-61500 HFS is a flaw in the Rejetto HTTP File Server (HFS) 3.x file server, which security firm VulnCheck has already recorded attempts to exploit. The vulnerability was disclosed on September 30, 2026, by researchers from Horizon3 and, according to their analysis, could lead to administrator-session forgery and remote code execution on the server.
VulnCheck said its Canary Intelligence system detected exploitation attempts beginning October 1, 2026. The company also added the flaw to its own catalog of known exploited vulnerabilities, referred to as KEV. This is not an addition to the CISA KEV catalog.
CVE-2026-61500 HFS: A Problem with Session Cookies
According to Horizon3’s technical analysis, the issue is related to how session cookies are signed. HFS uses the predictable output of the Math.random() function for this purpose. If an attacker obtains additional outputs from the same generator, they may, according to the described scenario, derive the values needed to create a valid administrator session.
This forged session could provide an attacker with administrator privileges without standard login. This could then lead to code execution on the server with the privileges of the HFS process. For internet-accessible, unpatched HFS 3.x instances, this therefore represents a risk of remote compromise without valid login credentials.
VulnCheck Sees Attempts, but the Scope of Incidents Is Unknown
The information about active exploitation attempts comes from VulnCheck telemetry. The available materials do not state how many systems were compromised as a result of the flaw, nor do they identify the individuals or groups behind the detected attempts. The claim therefore does not, by itself, confirm a widespread attack campaign.
HFS serves as an HTTP file server. Successful takeover of an administrator session and code execution could therefore threaten data made available through the server as well as the host system itself. The specific impact depends on the service configuration and the privileges under which the HFS process runs.
Recommended Update and Activity Monitoring
The Rejetto project has newer HFS releases available. The GitHub Releases page identifies version 3.3.4, released on September 30, 2026, as the latest stable release. However, the primary materials available during this review do not clearly establish the exact version in which CVE-2026-61500 was fixed.
Operators of HFS 3.x should therefore deploy the latest stable release and verify the fix status in their own installation. Particular attention should be paid to publicly accessible servers, and logs should be reviewed for unusual administrator sessions or server-code execution.
Further developments may bring direct confirmation from the Rejetto project of the vulnerable and fixed versions, possible advisories from national CERT teams, or inclusion of the flaw in CISA KEV. Independent confirmation of specific compromises or malware associated with this vulnerability will also be relevant.
Sources
- Horizon3 – Technical description of CVE-2026-61500, the session-cookie forgery chain, and the possibility of RCE.
- VulnCheck – Claim that Canary Intelligence recorded exploitation attempts beginning October 1, 2026, and addition to VulnCheck KEV.
- Rejetto HFS GitHub Releases – Current project releases; version 3.3.4 is marked as Latest on the page.
Verified and updated: 10/05/2026 15:22
