Critical RCE in Rejetto HFS (CVE‑2026‑61500) Enables Session Forgery and Remote Code Execution
What It Is – A newly disclosed vulnerability in Rejetto HTTP File Server (HFS) versions 3.0.0‑3.2.0 allows an attacker to reconstruct the server’s session‑cookie signing key by harvesting a few login responses. With the recovered key the attacker can forge an administrator session cookie and trigger remote code execution via the built‑in server_code feature.
Exploitability – Proof‑of‑concept code and a detailed write‑up have been published. Threat‑intel feeds report active scanning from at least one IP address in China targeting deployments in Japan and the United States. No confirmed compromises have been disclosed yet.
Affected Products – Rejetto HFS (open‑source file‑sharing server) on Windows, Linux and macOS, versions 3.0.0 through 3.2.0. The issue is patched in version 3.2.1; later releases (3.3.4) also contain the fix.
Why It Matters for Trust & Control Assurance
- Session integrity control – Weak, predictable signing keys break the control objective of cryptographically protected authentication sessions, a requirement across SOC 2, ISO 27001, NIST CSF and many others.
- Evidence of due‑diligence – Continuous monitoring that shows all file‑server instances run a patched version provides defensible audit evidence of control enforcement.
- Defensible incident response – Detecting anomalous admin‑session cookies early limits exposure and supports a credible breach‑response narrative for regulators and customers.
Recommended Actions
- Upgrade every Rejetto HFS instance to 3.2.1 or later (preferably 3.3.4).
- Verify that the session‑cookie signing key is generated by a cryptographically secure PRNG; replace any custom implementations.
- Deploy continuous monitoring to inventory file‑server versions and alert on any out‑of‑date deployments.
- Review server logs for unexpected admin‑session cookies or
server_codeexecutions.
Source: BleepingComputer – Rejetto HFS servers now actively scanned for critical RCE flaw