Rejetto HFS servers now actively scanned for critical RCE flaw

Security researchers at VulnCheck have detected scanning activity targeting Rejetto HFS (HTTP File Server) installations vulnerable to CVE-2026-61500, a severe flaw enabling session forgery, account hijacking, and remote code execution. According to VulnCheck's Caitlin Condon, the probes so far appear limited, originating from a single China Telecom IP address and aimed at systems in Japan and the US. The bug stems from HFS versions 3.0.0 through 3.2.0 using the insecure Math.random() function to generate session-cookie signing keys while also exposing outputs from that same generator to unauthenticated users during login—allowing attackers to reconstruct the key, forge an admin session, and run malicious code via the server's custom JavaScript feature. The issue was uncovered by Horizon3 using Anthropic's Mythos model and was patched in HFS 3.2.1, though a proof-of-concept released by Horizon3 on September 30, 2026 may explain the recent scanning surge. Administrators should update to version 3.2.1 or, preferably, the current release 3.3.4 immediately.