Critical CVE-2026-61500 in Rejetto HFS Allows Admin Session Forgery Leading to Remote Code Execution

A critical vulnerability identified as CVE-2026-61500 is being actively exploited in Rejetto HTTP File Server (HFS), allowing remote attackers to forge administrator sessions and achieve remote code execution without authentication.

The issue affects HFS versions 3.0.0 to 3.2.0 inclusive and has been fixed in version 3.2.1. Security teams are urged to prioritize updates for any instances exposed to the internet, as the flaw carries a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8, and is associated with CWE-338 (use of a cryptographically weak PRNG).

The root cause stems from how HFS generates the signing key for session cookies. Instead of using a cryptographically secure random number generator, the software relies on JavaScript Math.random(), which is intended for general-purpose use rather than security applications. The login flow exposes enough outputs from this generator that a patient attacker can reconstruct its internal state after observing only a few responses.

With the reconstructed state, the attacker can forge valid session cookies granting full administrator privileges. From there, the attacker can abuse the server_code configuration option to execute arbitrary JavaScript on the server side, turning session forgery into a straightforward case of remote code execution.

A Python proof-of-concept exploit was publicly released in late September 2026. On October 1, 2026, exploitation attempts were detected against vulnerable systems in the United States, with activity linked to an unidentified actor operating from China.

Administrators should immediately update to HFS 3.2.1 or later. Prior to patching, organizations are advised to identify all internet-facing instances running versions 3.0.0–3.2.0, restrict administrative interfaces to trusted networks, implement network segmentation, and monitor logs for suspicious activity involving the get_config and set_config endpoints.

As a temporary mitigation, administrators may configure robust signing keys via COOKIE_SIGN_KEYS, although this does not replace the official patch. In cases of suspected compromise, simply applying the update is insufficient; credentials must be rotated, system integrity verified, and configuration changes reviewed.