Active Scanning Detected for Rejetto HFS Critical Vulnerability
Hackers have begun actively scanning for a critical remote code execution (RCE) vulnerability in Rejetto HFS, tracked as CVE-2026-61500, according to security researchers. The activity was first observed by VulnCheck’s Canary Intelligence honeypots, which detected probing attempts originating from a single China Telecom IP address targeting systems in Japan and the United States.
Caitlin Condon, VP of Security Research at VulnCheck, shared the findings on LinkedIn over the weekend, noting that while the scanning appears to be small-scale reconnaissance, it indicates growing attacker interest in the flaw. The vulnerability affects Rejetto HFS versions 3.0.0 through 3.2.0 and stems from a weak session-cookie signing mechanism.
How the Flaw Enables Remote Code Execution
The core issue lies in how Rejetto HFS generates session-cookie signing keys. Versions prior to 3.2.1 derive this key from the non-cryptographic Math.random() generator. Worse, the application inadvertently leaks outputs of this same generator to unauthenticated clients during the login process.
As described in the NIST NVD entry for CVE-2026-61500, an attacker can collect a small number of these login responses, reconstruct the internal state of the Math.random() generator, and recover the signing key. With this key, they can forge a valid administrator session cookie.
Once armed with an admin session, attackers can exploit HFS’s built-in server_code configuration feature to execute arbitrary server-side JavaScript, leading to full remote code execution on the host system.
Discovery and Technical Details
The flaw was identified by Horizon3 researchers using Anthropic’s Mythos AI model. According to their analysis, Mythos did not merely flag the insecure use of Math.random() in isolation. Instead, it recognized the combination of weak key generation and the unintended leakage of its outputs as a exploitable chain.
As Horizon3 explained, "Mythos didn't just flag the insecure PRNG in isolation – it simultaneously identified that the application leaked raw Math.random() outputs through a separate code path, recognized those two facts as a chain, and determined the leak produced exactly the observations needed to make state recovery feasible."
The researchers published a detailed write-up and proof-of-concept (PoC) exploit on September 30, 2026, demonstrating how the recovered session key could be used to forge admin access and trigger RCE via the server_code functionality.
Risk and Recommended Mitigations
Successful exploitation could allow attackers to access, steal, or delete files hosted on the HFS server, install malware, or use the compromised system as a pivot point to infiltrate internal networks. However, VulnCheck has not yet confirmed any instances of successful exploitation or post-compromise activity in the wild.
Rejetto addressed the vulnerability in version 3.2.1, released on July 13, 2026, by replacing the insecure Math.random()-based key generation with a cryptographically secure alternative and eliminating the information leak. Users are strongly advised to upgrade to HFS 3.2.1 or later immediately.
The current latest stable release is version 3.3.4, which includes the fix and additional security improvements. Organizations running exposed HFS instances should prioritize patching and consider restricting access to trusted networks or using authentication gateways where immediate updates are not feasible.
Source: BleepingComputer