{"id":3377,"date":"2026-10-05T09:24:17","date_gmt":"2026-10-05T09:24:17","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3377"},"modified":"2026-10-05T09:24:17","modified_gmt":"2026-10-05T09:24:17","slug":"attackers-target-rejetto-hfs-flaw-that-enables-admin-session-forgery-and-rce","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3377","title":{"rendered":"Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 05, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck.<\/p>\n

The vulnerability in question is CVE-2026-61500<\/strong> (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and seize control of affected systems.<\/p>\n

\u00abRejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login,\u00bb according to an advisory<\/a> for the flaw.<\/p>\n

\u00abA remote attacker can collect a small number of login responses, reconstruct the generator’s state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.\u00bb<\/p>\n

Horizon3.ai researcher Zach Hanley, in a post published<\/a> on September 30, 2026, said Anthropic’s Mythos model was used to discover the vulnerability, describing it as an authentication bypass that facilitates arbitrary remote code execution on Rejetto HFS.<\/p>\n

\u00abRejetto HFS’s administrative API allows for custom endpoints that can execute arbitrary JavaScript,\u00bb Hanley said. \u00abCombined, this presented a clear path from unauthenticated access to administrative control, and ultimately, remote code execution.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

A patch for the vulnerability was released in July 2026 in version 3.2.1<\/a>. However, it was not until late September that a Python-based proof-of-concept (PoC) exploit was publicly released by a security researcher named Alejandro Ramos (aka aramosf).<\/p>\n

<\/p>\n

\u00abHFS generated its Koa session-cookie signing key with JavaScript Math.random() and exposed outputs from the same V8 PRNG in the unauthenticated SRP login handshake,\u00bb Ramos noted<\/a>. \u00abAn attacker can reconstruct the PRNG state, recover the signing key, forge an administrator session, and use the documented server_code configuration feature to execute server-side JavaScript.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

According to VulnCheck’s Patrick Garrity, exploitation attempts were detected<\/a> on October 1, 2026, a day after Horizon3.ai published additional details of the flaw. The cybersecurity company said it identified an unnamed threat actor in China targeting real vulnerable hosts in the U.S.<\/p>\n

CVE-2026-61500 is the second vulnerability in Rejetto HTTP File Server after CVE-2024-23692<\/a> (CVSS score: 9.8) to come under active exploitation in the wild. In July 2024, multiple threat actors were observed weaponizing the flaw to deliver cryptocurrency miners, trojans, and a malware named HATVIBE.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 05, 2026Vulnerability \/ Web Security A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is…<\/p>\n","protected":false},"author":1,"featured_media":3378,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[129,622,724,70,3657,3656,316,3655,1161,492],"class_list":["post-3377","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-admin","tag-attackers","tag-enables","tag-flaw","tag-forgery","tag-hfs","tag-rce","tag-rejetto","tag-session","tag-target"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3377"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3377\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3378"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}