Rejetto HFS servers now actively scanned for critical RCE flaw

CVE-2026-61500

The Rejetto HFS (HTTP File Server) software, a popular open-source tool for self-hosted file sharing, is currently facing active exploitation attempts due to a critical vulnerability identified as CVE-2026-61500. This flaw stems from a fundamental weakness in how the software generates and handles session cookies. Specifically, versions 3.0.0 through 3.2.0 of Rejetto HFS use a non-cryptographic random number generator, Math.random(), for deriving session-cookie signing keys. Compounding this issue, the application inadvertently leaks outputs from this same generator to unauthenticated clients during the login process.

Horizon3 Researchers

This critical vulnerability was brought to light by Horizon3 researchers, who utilized Anthropic's Mythos AI model to identify the exploit chain. The AI model was instrumental not only in flagging the insecure pseudo-random number generator (PRNG) but also in recognizing that the application's separate code path leaked the necessary raw Math.random() outputs. Horizon3's write-up details how this leak provided the exact observations needed to reconstruct the generator's internal state, thereby enabling the recovery of the session signing key. This discovery was further validated by a proof-of-concept (PoC) exploit released on September 30, 2026, which demonstrates the abuse of HFS's built-in server-side JavaScript execution capabilities to achieve remote code execution.

VulnCheck Canary Intelligence

Following the public disclosure of the vulnerability and the release of the PoC, security firms have observed active scanning for vulnerable servers. VulnCheck's Canary Intelligence honeypots detected probes targeting CVE-2026-61500, originating from a single China Telecom IP address and targeting deployments in Japan and the United States. While the observed activity is described as small-scale reconnaissance, it signifies a clear intent by threat actors to exploit this weakness. Potential attack scenarios include unauthorized access, modification, or deletion of files, deployment of malware, or using the compromised server as a pivot point into internal networks. Users are strongly advised to upgrade to Rejetto HFS version 3.2.1 or later, ideally the latest stable release, 3.3.4, to mitigate these risks.