Rejetto HFS vulnerability exploited for remote code execution

A critical security vulnerability in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, is currently being exploited in the wild. The flaw, which carries a CVSS score of 9.3, allows attackers to bypass authentication, gain full administrative access, and achieve remote code execution (RCE).

The vulnerability stems from the use of a weak, non-cryptographic pseudo-random number generator (Math.random()) to derive session-cookie signing keys. By collecting login responses, an attacker can reconstruct the generator’s state, recover the signing key, and forge valid administrator session cookies. This process is facilitated by the server's administrative API, which allows for custom endpoints that can execute arbitrary JavaScript.

Notably, the flaw was discovered through AI-assisted research using Anthropic’s Mythos model as part of Horizon3.ai’s Project Glasswing. While a patch was released in July 2026 in version 3.2.1, active reconnaissance and exploitation attempts have been detected by VulnCheck following the public release of a Python-based proof-of-concept exploit in late September.