Critical Security Flaw in Rejetto HFS Puts Exposed Servers at Risk

A critical Rejetto HTTP File Server (HFS) vulnerability could allow attackers to bypass authentication, gain administrator access and execute malicious code on vulnerable servers.

The vulnerability, tracked as CVE-2026-61500, is linked to a weakness in how HFS generates authentication session keys. Researchers demonstrated that attackers could use exposed random-number values to recover the signing key and forge an administrator session.

The reported attack chain could lead to remote code execution (RCE), putting sensitive files and connected systems at risk. Organisations using affected HFS versions should prioritise patching and check for signs of exploitation.

What Is CVE-2026-61500?

CVE-2026-61500 is a security vulnerability involving the generation and recovery of authentication session-signing keys in Rejetto HFS.

The application used JavaScript's Math.random() function to generate values used in signing authentication session cookies. However, this function is not designed for cryptographic security. The application also exposed outputs from the same random-number generator to unauthenticated clients during the login process.

Who Is Affected?

Organisations running Rejetto HFS versions 3.0.0 through 3.2.0 should assess their exposure and prioritise remediation.

Particular attention should be given to systems that are:

• Directly accessible from the internet.

• Used to exchange confidential business, customer or financial information.

• Connected to internal corporate networks or other critical systems.

• Running with elevated operating-system privileges.

• Accessible from untrusted or semi-trusted networks.

Potential Business and Security Impact

Successful exploitation could expose organisations to several security risks:

• Unauthorised administrative access: Attackers may impersonate an administrator without valid credentials.

• Remote code execution: Exploitation of the attack chain could enable arbitrary code execution on the affected server.

• Data exposure: Sensitive files stored on or exchanged through the server could be accessed or compromised.

• Malware deployment and persistence: A compromised server could be used to introduce malicious files, establish persistence or support further attacks.

• Internal network compromise: Where the server has connectivity to other systems, attackers may attempt to expand their access.

• Business disruption: Compromise of file-sharing services could interrupt operations and affect the confidentiality, integrity and availability of business information.

Recommendation

• Update HFS: Upgrade affected installations to the latest stable version to fix the vulnerability.

• Check Exposed Servers: Identify vulnerable HFS installations and restrict unnecessary internet access.

• Review Access: Check administrator accounts and login activity for suspicious or unauthorised access.

• Hunt for Threats: Review security logs and endpoint alerts for unusual processes, files or network connections.

• Respond to Suspected Compromise: Isolate affected servers and investigate before returning them to service.

Organizations in Nigeria and across Africa can strengthen their security posture with esentry’s Vulnerability Management, Threat Intelligence and SOC Monitoring services. Our services help identify security weaknesses in exposed systems, monitor emerging cyber threats and detect suspicious activities, enabling organizations to address vulnerabilities before they lead to serious security incidents.

‍