Rejetto HFS Servers Face Active Exploitation of Critical Signing Key Flaw

How Attackers Are Forging Sessions to Gain Control

Hackers are actively scanning the internet for Rejetto HTTP File Server (HFS) instances vulnerable to a critical remote code execution flaw identified as CVE-2026-61500. The vulnerability stems from a weak cryptographic signing key that enables attackers to forge session tokens, hijack user accounts, and execute arbitrary code on affected servers. Security researchers at VulnCheck first disclosed the issue after observing increased scanning activity targeting HFS deployments worldwide. The flaw allows unauthenticated remote attackers to bypass authentication mechanisms and gain full control over vulnerable systems without requiring prior access.

The vulnerability exists in the session handling mechanism of Rejetto HFS versions prior to 2.4.0, where insufficient entropy in the signing key generation process makes it predictable. Attackers can exploit this by crafting malicious session cookies that grant administrative privileges, leading to potential data theft, malware installation, or use of the server as a pivot point for further network intrusion. Caitlin Condon, VP of Security Research at VulnCheck, noted that the scanning activity indicates automated exploitation attempts are already underway, urging administrators to prioritize patching or implementing mitigations immediately.

What Steps Should Administrators Take Now to Protect Their Systems?

The core issue lies in HFS’s use of a static or weakly random seed for generating session signatures, which reduces the cryptographic strength of tokens used to validate user sessions. By analyzing network traffic or brute-forcing limited key spaces, attackers can predict valid session tokens and impersonate any user, including administrators. Once inside, they can upload malicious scripts, modify server configurations, or execute system commands directly through the HFS web interface. This level of access turns a seemingly benign file-sharing tool into a significant foothold within corporate or home networks.

Administrators running Rejetto HFS should immediately upgrade to version 2.4.0 or later, which includes a cryptographically secure session key generation process. For those unable to patch immediately, restricting HFS access to trusted networks via firewall rules or disabling remote administration features can reduce exposure. Monitoring logs for unusual session activity, unexpected file uploads, or authentication anomalies is also critical. VulnCheck recommends validating server configurations against their published indicators of compromise to detect potential breaches early.

What versions of Rejetto HFS are affected by CVE-2026-61500? All versions prior to 2.4.0 contain the weak signing key vulnerability and are susceptible to session forgery and remote code execution.

Frequently Asked Questions

Can this vulnerability be exploited without any user interaction? Yes, the flaw allows unauthenticated remote attackers to forge valid session tokens and gain administrative access without needing credentials or triggering user actions.

Is there a temporary workaround if patching is not immediately possible? Limiting HFS server access to specific IP addresses or local networks and disabling internet-facing exposure can mitigate risk until a permanent update is applied.