Critical Rejetto HFS Vulnerability Under Active Exploitation by China-Based Threat Actors
Executive Summary
In October 2026, threat actors began actively exploiting CVE-2026-61500, a critical vulnerability in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The flaw stems from weak pseudo-random number generation using JavaScript's Math.random() for session cookie signing keys, enabling attackers to forge administrator sessions and achieve remote code execution. VulnCheck detected exploitation attempts by China-based threat actors targeting vulnerable U.S. systems just one day after proof-of-concept code was publicly released. Despite a patch being available since July 2026 in version 3.2.1, many organizations remain vulnerable due to delayed patching cycles.
This incident highlights the growing sophistication of vulnerability research, as the flaw was originally discovered using Anthropic's Mythos AI model, demonstrating how artificial intelligence is accelerating both defensive research and offensive capabilities in cybersecurity.
Why This Matters Now
The rapid weaponization of CVE-2026-61500 within 24 hours of public disclosure exemplifies the compressed timeline between vulnerability publication and active exploitation, demanding immediate patching protocols and proactive vulnerability management in an era of AI-accelerated threat research.
Attack Path Analysis
Attackers exploited CVE-2026-61500 in Rejetto HFS to bypass authentication through weak PRNG session forgery, gaining administrative access and executing remote code. The vulnerability stems from predictable Math.random() session keys that can be reconstructed from login responses, leading to full server compromise and potential lateral movement across network segments.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actors identified and exploited CVE-2026-61500 in Rejetto HFS servers, collecting login responses to reconstruct the weak PRNG state and forge administrator session cookies for unauthorized access
Related CVEs
CVE-2026-61500
CVSS 9.8A session forgery vulnerability in Rejetto HFS 3.0.0 through 3.2.0 allows remote attackers to forge administrator session cookies and achieve remote code execution through weak PRNG implementation.
Affected Products:
Rejetto HTTP File Server (HFS) – 3.0.0, 3.0.1, 3.1.0, 3.2.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Command and Scripting Interpreter: JavaScript
Exploitation for Credential Access
Steal or Forge Kerberos Tickets
Exploitation for Privilege Escalation
Server Software Component: Web Shell
Active Scanning: Vulnerability Scanning
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Vulnerability Management and Patching
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Authentication and Session Management
Control ID: Identity.AM-6
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2(a)
ISO 27001:2022 – Secure Development Policy
Control ID: A.14.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical exposure to CVE-2026-61500 RCE vulnerability in Rejetto HFS with active exploitation enabling administrative session forgery and complete system compromise.
Computer Software/Engineering
High risk from weak PRNG implementation allowing predictable session keys, enabling threat actors to forge administrator access and execute arbitrary code.
Computer/Network Security
Direct impact from authentication bypass vulnerabilities requiring immediate patching, enhanced segmentation controls, and anomaly detection to prevent lateral movement exploitation.
Telecommunications
Significant threat from China Telecom-sourced reconnaissance attacks targeting vulnerable HTTP file servers, requiring encrypted traffic monitoring and egress security enforcement.
Sources
- Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCEhttps://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.htmlVerified
- Rejetto HFS Session Forgery and RCE Vulnerability Advisoryhttps://github.com/advisories/GHSA-xxrm-3f86-v97jVerified
- Anthropic Mythos Rejetto HFS RCE Discovery Researchhttps://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/Verified
- CVE-2026-61500 Proof of Concept Exploithttps://github.com/aramosf/CVE-2026-61500Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would constrain the CVE-2026-61500 HFS exploitation by limiting network reachability and reducing lateral movement scope. Zero Trust segmentation would reduce attacker blast radius across compromised environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network visibility and traffic inspection could potentially identify suspicious authentication patterns and unusual session behavior during the PRNG exploitation attempts against HFS servers
Control: Zero Trust Segmentation
Mitigation: Identity-aware access controls would likely constrain the scope of administrative privileges available to forged sessions, potentially limiting the execution of server_code configuration changes
Control: East-West Traffic Security
Mitigation: Network segmentation controls would likely restrict lateral movement paths from compromised HFS servers, constraining attacker ability to reach additional systems and services across network segments
Control: Multicloud Visibility & Control
Mitigation: Network visibility controls would likely detect and constrain suspicious outbound communication patterns from compromised HFS servers to external attacker infrastructure and command channels
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy controls would likely constrain large-scale data transfers and suspicious file access patterns, reducing the volume and scope of potential data exfiltration from compromised servers
Residual impact would likely be constrained to segmented HFS server environments, with reduced ability to spread malware across the broader infrastructure due to network isolation controls
Impact at a Glance
Affected Business Functions
- File Sharing Services
- Web Server Operations
- Remote Access Systems
- Administrative Functions
Estimated downtime: 2 days
Estimated loss: N/A
Full administrative access to file server contents, potential exposure of shared files and server configuration data, remote code execution capabilities allowing access to server filesystem and network resources
Recommended Actions
Key Takeaways & Next Steps
- • Implement inline IPS with Suricata signatures to detect and block CVE-2026-61500 exploit attempts against vulnerable HFS servers
- • Deploy zero trust segmentation with least privilege policies to prevent lateral movement from compromised file servers to critical network segments
- • Enable multicloud visibility and control to detect anomalous authentication patterns and session forgery attempts through traffic observability
- • Establish egress security policies to prevent unauthorized data exfiltration and block connections to known malicious infrastructure
- • Implement threat detection and anomaly response capabilities to identify suspicious administrative access patterns and malware deployment activities
