CVE-2026-61500: Rejetto HFS Session Forgery to RCE

Rejetto HTTP File Server (HFS) users now face active probing of CVE-2026-61500. VulnCheck began detecting probes targeting CVE-2026-61500 on October 1, 2026, after Rejetto had patched the flaw in July.

CVE-2026-61500 is a critical authentication weakness affecting Rejetto HFS 3.0.0 through 3.2.0. It carries a CVSS v4.0 score of 9.3. The vulnerability exposes outputs from the non-cryptographic PRNG used to create the HFS session-cookie signing key. An unauthenticated attacker can reconstruct that key and forge an administrator session. The forged session can then provide access to functionality capable of server-side code execution.

Rejetto released HFS 3.2.1 on July 13, 2026, addressing the security issues. Organizations running affected HFS 3.x versions should prioritize remediation.

CVE-2026-61500 at a Glance

Vulnerability and version details are documented by VulnCheck and the Rejetto HFS release record.

How Predictable Randomness Lets Attackers Forge HFS Admin Sessions

CVE-2026-61500 stems from how HFS generated and protected session cookies.

HFS generated a value using JavaScript’s Math.random() and passed that value to Koa, the Node.js web framework used by HFS. Koa then used the value to sign session cookies.

The weakness became exploitable because HFS also exposed outputs from the same PRNG during login. Mythos identified the mathematical connection between the Math.random() values used for session signing and the raw PRNG output leaked through the login process, showing that the two weaknesses could be chained for state recovery.

Horizon3’s technical analysis describes the chain:

• HFS derives the cookie-signing value from Math.random().
• V8 implements the relevant PRNG using the reversible xorshift128+ algorithm.
• The HFS login process exposes additional Math.random() outputs to clients.
• The documented exploit samples the unauthenticated login endpoint approximately 12 times to collect leaked PRNG values, then uses those observations to reconstruct the V8 xorshift128+ internal state.
• The attacker steps backward through that state to recover the session-signing key.
• The recovered key can sign a fabricated administrator session cookie.
• The forged administrator session provides access to HFS functionality capable of executing server-side code.

The documented Horizon3 exploit sampled the unauthenticated endpoint multiple times before reconstructing the state and forging the administrator cookie.

Notably, the relevant login operation requires a valid login-enabled username but does not require that user’s password to disclose the PRNG output. Horizon3 also documented a user-enumeration technique for validating that the built-in administrator account existed.

This makes CVE-2026-61500 more than a conventional login bypass. It converts information exposed during authentication into the cryptographic material needed to create a trusted administrator session.

What Active Probing of CVE-2026-61500 Actually Confirms

The distinction between exploit capability and observed attacker activity matters.

Horizon3 demonstrated the full path from unauthenticated access to forged administrator authentication and arbitrary command execution during vulnerability research.

VulnCheck reported that its Canary Intelligence systems began observing activity targeting CVE-2026-61500 on October 1, 2026. It subsequently added the vulnerability to the VulnCheck Known Exploited Vulnerabilities database. At the time, its internet telemetry identified roughly 100 internet-facing HFS instances.

SecurityWeek reported that activity reached canaries in Japan and the United States and originated from a China Telecom IP address.

However, the available public reporting does not establish:

• which organizations, if any, were successfully compromised;
• whether attackers deployed malware;
• whether attackers established persistence;
• whether information was stolen;
• whether lateral movement followed exploitation; or
• whether the exact Horizon3 proof-of-concept sequence was used in the observed attacks.

Organizations should treat active targeting of CVE-2026-61500 as confirmed, while avoiding claims of successful compromise or post-exploitation activity that public reporting has not established.

Upgrade HFS 3.0.0–3.2.0 and Verify Remediation

Rejetto released HFS 3.2.1 on July 13, 2026. Its release notes state that multiple security vulnerabilities affected previous versions and could allow administrative access to HFS.

For CVE-2026-61500 specifically, VulnCheck identifies HFS 3.0.0 through 3.2.0 as affected. Organizations running these versions should upgrade to HFS 3.2.1 or a later fixed release.

IT and security teams should follow these steps:

• Inventory HFS 3.x deployments. Identify HFS installations across the environment and record the installed version. Do not rely only on server ownership records or existing asset lists.
• Upgrade affected versions. Prioritize HFS 3.0.0 through 3.2.0 and move affected installations to HFS 3.2.1 or a later fixed release.
• Verify remediation. Confirm the installed HFS version after deployment rather than treating an initiated update as proof that remediation succeeded.
• Restart HFS where required by the deployment process. If the upgrade does not already restart the HFS process, restart it after applying the fixed release so the patched process initializes its session-signing state. Do not present manual session invalidation as a documented Rejetto remediation requirement.
• Investigate suspicious activity where exposure existed. Active probing of CVE-2026-61500 has been observed. However, public sources do not currently document successful victim compromise, a standard post-exploitation payload, or a persistence mechanism.

The HFS application update is the primary remediation for CVE-2026-61500. Generic operating-system patching should not be treated as a substitute for updating the vulnerable HFS installation.

Featured resource

Hexnode UEM for Patch Management

See how Hexnode UEM centralizes patch visibility, deployment, compliance tracking, and vulnerability insights across supported Windows and macOS endpoints.

Download the One-pager

Using Hexnode UEM to Check HFS Versions on Managed Windows Devices

For HFS installations on supported Windows 10 v1709+ or Windows 11 PCs and tablets enrolled through the Hexnode Installer app, you can use Hexnode UEM scripting to support version discovery and organization-defined remediation workflows.

The Execute Custom Script remote action for Windows supports PowerShell and Batch scripts. You can remotely execute scripts and store selected script output in a custom device attribute. Hexnode recommends validating scripts on a test device before deploying them more broadly.

For CVE-2026-61500, you could develop and test a PowerShell workflow that:

• checks whether Rejetto HFS is present;
• retrieves the installed HFS version;
• returns the version through script output;
• stores the result in a pre-configured Hexnode custom attribute created via Admin > Custom Attributes (Devices); and
• runs an organization-approved remediation script or deployment process where appropriate.

On Windows, you can also populate custom attributes with script output for later review. This can help surface HFS version information across managed devices.

Hexnode UEM also provides CVE discovery and patch workflows for supported applications. However, our current documentation does not confirm native coverage for Rejetto HFS or CVE-2026-61500. Where HFS-specific coverage remains unverified, you can use tested custom scripts to support version discovery and remediation.

The remediation logic should come from your organization’s tested script and software-deployment process. Before fleet-wide execution, validate detection paths, version parsing, installer behavior, exit codes, and rollback requirements.

CVE-2026-61500 Turns Login Randomness Into an Administrator Session

The distinctive risk behind CVE-2026-61500 comes from combining two weaknesses: HFS used a reversible, non-cryptographic generator for security-sensitive session signing while also exposing outputs from that generator to unauthenticated clients.

That combination gives an attacker the information needed to reconstruct the signing key and create a trusted administrator session without possessing the administrator password.

With active probing now observed, organizations should prioritize remediation of affected HFS 3.x deployments. Hexnode UEM scripts can also help managed Windows environments identify HFS versions where native CVE coverage has not been verified.