[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_U4JC_UtFEI1wQPB5K7gcqY33mHV-MFnkc1ZkasNXiY":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"fed8746e-f0de-4680-8b91-a5f92c4dc7f9","Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE","attackers-target-rejetto-hfs-flaw-that-enables-admin-session-forgery-and-rce-00cd8a","A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and","A critical vulnerability (CVE-2026-61500) in Rejetto HTTP File Server (HFS) is being actively exploited, allowing attackers to forge admin sessions and achieve remote code execution. The flaw stems from a weak PRNG used for session cookie signing, enabling attackers to recover the signing key. A patch was released in July 2026, but exploitation attempts were detected in October 2026 by an unnamed threat actor in China targeting US hosts.","Attackers exploit Rejetto HFS flaw CVE-2026-61500 for admin session forgery and RCE.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-target-rejetto-hfs-flaw-that.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiTCvFj7lVSH1eLS0oYdxqBa4wQkNQvuemuCAL5XqwKueywAUl8Fg6zY-5UT9cdx3fZZ81DHX_emE9JXthW_OfH-axyWn3bE5CpCp4CDs4HREWjv_1uBtt5iJE947S-Bkn-4Mn1Shwt1kV9FF4RO9Wa7_4jmUtvbWrx2zs4-cdSg-FkUtxW-erVx2CXKhU3\u002Fs1600\u002Fhfs-rce-main.jpg","2026-10-05T08:09:23+00:00","2026-10-05T10:00:15.091325+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"HTTP File Server (HFS)","product",{"name":21,"type":22},"Rejetto","vendor",{"name":24,"type":25},"unnamed threat actor","threat_actor",{"name":27,"type":19},"Mythos",{"name":29,"type":22},"Anthropic","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"cve","CVE-2026-61500","Rejetto HFS session forgery and RCE vulnerability",{"type":50,"value":54,"context":55},"CVE-2024-23692","Previous Rejetto HFS vulnerability exploited for malware delivery",[21,29,18],{"controls":58,"vendors":145},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":47,"name":118,"problem":119,"products":120},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":162},"rejetto-hfs-weak-prng-allows-admin-session-forgery-and-rce","Rejetto HFS Weak PRNG Allows Admin Session Forgery and RCE","A critical flaw in Rejetto HTTP File Server stems from the use of a cryptographically weak Pseudo-Random Number Generator (PRNG) to sign session cookies, allowing attackers to mathematically recover the signing key and forge administrative sessions. Once admin access is obtained, attackers can achieve full Remote Code Execution on the host system. A patch was available in July 2026, yet active exploitation was not detected until October 2026 — a three-month window during which unpatched systems remained exposed. This incident highlights the danger of deploying internet-facing file-sharing services without rigorous patch cadence and cryptographic hygiene. The use of weak PRNGs in security-sensitive operations like session management is a foundational design flaw that should be caught during development and code review.",[151,152,153,154,155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-13: Cryptographic Protection","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","OWASP A02:2021 – Cryptographic Failures","OWASP A05:2021 – Security Misconfiguration","ITIL Change Management: Emergency Change procedures for critical vulnerabilities",{}]