Rejetto HFS PRNG Flaw Enables Cookie Forgery and RCE — Patch Now
Written by AI from the linked story. Not reviewed by an editor. How this works
The root cause of CVE-2026-61500 is a critical cryptographic weakness: Rejetto HFS used JavaScript's non-cryptographic Math.random() PRNG to sign session cookies, making the signing key predictable and recoverable by attackers. Once the key is exposed, adversaries can forge administrator-level cookies and achieve full remote code execution without any credentials. A patch was available on July 13, yet active exploitation did not begin until October — meaning organizations had nearly three months to remediate but many did not. This incident underscores that internet-facing file-sharing services are high-value targets and that weak cryptographic primitives in session management can collapse an entire application's security boundary.
Tactical Insight
Immediate actions
- Upgrade all Rejetto HFS installations to version 3.2.1 or later immediately, as this is the only remediation for CVE-2026-61500.
- Take unpatched HFS instances offline or block external access via firewall rules until patching is complete.
- Rotate all existing session tokens and administrator credentials on affected systems after applying the patch.
Long-term improvements
- Enforce a cryptographically secure PRNG (e.g., crypto.getRandomValues() or equivalent) in all session-token and secret-key generation through secure coding standards and code review gates.
- Maintain a continuously updated inventory of all internet-facing services and apply critical patches within 72 hours of vendor release.
- Implement network segmentation so that file-sharing services are isolated from core infrastructure, limiting lateral movement if exploitation occurs.
Detection measures
- Deploy honeypots or canary tokens on file server endpoints to generate early-warning alerts for reconnaissance and exploitation attempts.
- Monitor authentication logs for anomalous administrator session activity, particularly sessions originating from unexpected geographies or IP ranges.
- Integrate threat intelligence feeds covering known malicious infrastructure (e.g., China Telecom ASNs flagged in this campaign) into SIEM alerting rules.