Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

What happened?

A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and

Key details

• Attacker can reconstruct PRNG state from login responses to recover signing key.
• Forged admin session grants full administrative access and remote code execution.
• Patch released in July 2026 for version 3.2.1 fixes the vulnerability.
• Exploitation detected starting October 1, 2026, targeting US hosts from China.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.