Hackers target Rejetto HFS servers following critical session forgery vulnerability discovery

Hackers are actively scanning for and attempting to exploit a critical security vulnerability in Rejetto HTTP File Server, BleepingComputer, The Hacker News, and SecurityWeek reported. The flaw, tracked as CVE-2026-61500, carries a CVSS score of 9.3 and allows attackers to achieve session forgery, account takeover, and remote code execution. VulnCheck observed the active threat activity targeting vulnerable servers. [1][2][3]

According to SecurityWeek, the issue stems from a weak pseudo-random number generator that leaks sensitive information. The Hacker News and SecurityWeek both reported that an attacker can collect a small set of login responses to reconstruct the generator state, recover the session-cookie signing key, and gain administrative access. [2][3]

BleepingComputer reported that VulnCheck Vice President of Security Research Caitlin Condon observed probes from honeypots over the weekend. The activity appeared to be small-scale reconnaissance originating from a single China Telecom IP address that targeted deployments in Japan and the United States. The scans followed the release of a public proof of concept demonstrating administrative session forgery, according to The Hacker News. [1][2]

SecurityWeek reported that VulnCheck initially discovered the weakness in June. Rejetto released HFS version 3.2.1 on July 13 with a patch to resolve the issue. System administrators running affected versions must update to the patched software to prevent unauthorized remote access. [3]