Exploitation Hits Rejetto HFS Vulnerability Discovered by AI

The root cause of CVE-2026-61500 is a critical cryptographic weakness: Rejetto HFS used JavaScript's non-cryptographic Math.random() PRNG to sign session cookies, making the signing key predictable and recoverable by attackers. Once the key is exposed, adversaries can forge administrator-level cookies and achieve full remote code execution without any credentials. A patch was available on July 13, yet active exploitation did not begin until October — meaning organizations had nearly three months to remediate but many did not. This incident underscores that internet-facing file-sharing services are high-value targets and that weak cryptographic primitives in session management can collapse an entire application's security boundary.