Somebody set up Rejetto HFS to share files “just for a bit,” and it is still answering on the internet. If it runs version 3.0.0 through 3.2.0, an attacker can forge an admin login without a password and run code on the box. A public exploit has been out since late September, and VulnCheck says the scanning started last week.
No password needed: a dozen login replies give away the admin key.
Predictable session key leads to admin and RCE
CVE-2026-61500 (CVSS 4.0 score 9.3) is a session-forgery flaw in Rejetto HTTP File Server, the free, open-source file-sharing server for Windows, Linux, or macOS. HFS 3.0.0 through 3.2.0 builds the key that signs session cookies from JavaScript’s non-cryptographic Math.random(), and it leaks outputs from the same generator to anyone who starts a login. Collect a handful of those replies, rebuild the generator’s state, recover the signing key, and you can mint a valid administrator cookie. From there, HFS’s built-in server_code feature runs server-side JavaScript, which means remote code execution.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The fix shipped in HFS 3.2.1 on July 13, 2026. Exploitation details came later. Horizon3.ai published its write-up and proof of concept on September 30, saying it found the chain with Anthropic’s Mythos model. Researcher Alejandro Ramos also released a Python proof of concept in late September. VulnCheck says its honeypots saw exploitation attempts starting October 1: small-scale reconnaissance from a single China Telecom address, probing canary systems in Japan and the United States. VulnCheck has not reported a successful compromise or post-exploitation activity.
HFS has been exploited before, and scanning has started
HFS has been through this before. An older bug, CVE-2024-23692, made CISA’s Known Exploited Vulnerabilities list and was used in 2024 to drop cryptocurrency miners and other malware. File servers like this tend to live on desks and side projects, outside the patch system. A public exploit plus active probing usually comes before mass use.
Find HFS, upgrade to 3.3.4, or pull it offline
- Find HFS. Ask desktop and engineering teams, plus the lab. Search your external attack-surface or scanner results for HFS web interfaces.
- Upgrade to 3.2.1 at minimum. The current stable release is 3.3.4 (September 30, 2026), and that is the better target.
- If you can’t upgrade today, take it off the internet or put it behind VPN.
- If it was exposed on 3.0.0–3.2.0, check the admin configuration for
server_codeyou did not write. Look for unfamiliar files and new accounts before you call it clean.
Forward this
If you run a small file-sharing server called HFS (Rejetto HTTP File Server): update it to 3.3.4, or at least 3.2.1, or unplug it from the internet today. Older 3.x versions can be taken over without a password, and attackers are already scanning for them.
Details
- CVE: CVE-2026-61500. Session forgery from a predictable signing key, leading to admin access and RCE via
server_code. CVSS 4.0 9.3 (VulnCheck). - Affected: Rejetto HFS 3.0.0 through 3.2.0.
- Fixed: 3.2.1 (July 13, 2026). Latest stable: 3.3.4 (September 30, 2026).
- Public exploit: Horizon3.ai write-up and PoC, September 30, 2026. Separate Python PoC by Alejandro Ramos, late September.
- Activity: VulnCheck saw exploitation attempts from October 1, 2026: reconnaissance from one China Telecom IP against canaries in Japan and the US. No confirmed successful exploitation reported.
- KEV: Not in CISA’s catalog as of October 5, 2026. The older HFS bug CVE-2024-23692 is.
Hunt / verify
- Confirm the running version in the HFS admin panel, not in an installer folder.
- Look for bursts of unauthenticated login-start requests from a single address in web or reverse-proxy logs. The attack needs a series of them to rebuild the key.
- Review admin sessions and configuration changes since September 30, especially anything under
server_code.
Upgrade Rejetto HFS to 3.3.4 (or at least 3.2.1), or pull it off the internet. CVE-2026-61500: forged admin cookie, then RCE via server_code. Public PoC since Sep 30. Scanning since Oct 1.
Sources
- https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/
- https://nvd.nist.gov/vuln/detail/CVE-2026-61500
- https://github.com/rejetto/hfs/releases
- https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/
- https://www.securityweek.com/exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai/
- https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
