Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

A critical vulnerability tracked as CVE-2026-61500 (CVSS 9.3) has been discovered in Rejetto HTTP File Server (HFS). The flaw stems from the use of a weak pseudo-random number generator (PRNG) that produces predictable session keys, enabling attackers to forge admin sessions. Successful exploitation can lead to unauthorized administrative access and remote code execution (RCE). Active exploitation attempts have been observed in the wild, as reported by VulnCheck. The vulnerability is classified as a session forgery issue, making it particularly dangerous for organizations hosting files via Rejetto HFS. Users are urged to patch or mitigate the flaw immediately given the active exploitation and high CVSS score.