Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

VulnCheck reports active exploitation of a severe flaw in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500 with a CVSS score of 9.3. Versions 3.0.0 through 3.2.0 generate session-cookie signing keys using the insecure JavaScript Math.random() function, and the login process leaks outputs from this same generator to unauthenticated users. By collecting a handful of login responses, an attacker can rebuild the generator's internal state, derive the signing key, and craft a fake administrator session cookie — ultimately achieving remote code execution through the server's server_code configuration option. Researchers say Anthropic's Mythos model helped uncover the issue, and a public Python proof-of-concept surfaced in late September, shortly before VulnCheck spotted real-world attack attempts on October 1, 2026 originating from a threat actor in China targeting hosts in the U.S. The vendor shipped a fix in version 3.2.1 back in July 2026, making this the second actively exploited Rejetto HFS vulnerability after 2024's CVE-2024-23692, which was previously abused to drop cryptominers, trojans, and the HATVIBE malware.