Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers actively scan for Rejetto HFS RCE flaw CVE-2026-61500 allowing session forgery and account takeover.
Hackers are actively scanning Rejetto HFS servers for a critical RCE vulnerability (CVE-2026-61500) that allows session forgery and account takeover. The flaw stems from a weak signing key derived from a non-cryptographic generator, which can be reconstructed by attackers. This allows for full administrative access and remote code execution, potentially leading to file theft, malware installation, or lateral movement.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Anthropic?
Get an email when a new story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe core failure here is the use of a non-cryptographic random number generator to derive a signing key, making session tokens predictable and forgeable by attackers. This design flaw allows threat actors to reconstruct the signing key, impersonate administrators, and achieve full remote code execution — all without needing stolen credentials. Active scanning activity means exposed servers are being targeted right now, increasing the urgency for immediate remediation. The risk extends beyond the server itself: successful exploitation can lead to lateral movement, malware deployment, and mass data theft across connected systems.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-61500