Attackers Exploit Rejetto HFS Session‑Forgery Flaw (CVE‑2026‑61500) for Remote Code Execution
What It Is — Rejetto HTTP File Server (HFS) contains a critical flaw (CVE‑2026‑61500) where a weak pseudo‑random number generator produces predictable session keys, enabling attackers to forge admin sessions and execute arbitrary code.
Exploitability — Active exploitation attempts have been observed in the wild; a proof‑of‑concept exists. CVSS v3.1 base score 9.3 (Critical).
Affected Products — Rejetto HTTP File Server 7.x and earlier (all platforms where the vulnerable PRNG is used).
Why It Matters for Trust & Control Assurance
- Weak session token generation violates the access‑control objective of ensuring only authenticated users can act with admin privileges.
- Continuous monitoring of authentication logs can surface anomalous session creation, providing defensible evidence for auditors.
- Demonstrating hardened session management is increasingly required by enterprise buyers during security‑risk assessments.
Recommended Actions
- Deploy the vendor‑released patch for CVE‑2026‑61500 immediately.
- Replace the built‑in PRNG with a cryptographically secure RNG or upgrade to a version that does so.
- Review and tighten session‑handling policies (shorter lifetimes, re‑authentication for privileged actions).
- Capture remediation evidence (patch version, configuration changes) for audit trails.
Source: The Hacker News