Is CVE-2026-61500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61500 being exploited in the wild.

How severe is CVE-2026-61500?

Critical severity, with a CVSS score of 9.8, published 13 July 2026.

Which products and versions are affected?

Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0.

Is there a fix for CVE-2026-61500?

A patch was published on 2026-07-13: Fixed in version 3.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61500 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61500?

Check whether you run Rejetto HFS (HTTP File Server) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61500: Rejetto HFS session cookie signing key forgery in HFS 3.x

CVE-2026-61500 · Severity: critical · CVSS 9.8 · Published 2026-07-13

Rejetto HFS, a popular file-sharing server, contains a security flaw in how it secures user sessions. An attacker can predict the secret keys used to sign login cookies by observing a few login attempts. This allows an unauthorized person to impersonate an administrator, take full control of the server, and execute malicious code, potentially leading to a complete system takeover and data theft.

Technologies: Rejetto HFS (HTTP File Server). Vendors: Rejetto.

Quick answers

Is CVE-2026-61500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61500 being exploited in the wild.
How severe is CVE-2026-61500?: Critical severity, with a CVSS score of 9.8, published 13 July 2026.
Which products and versions are affected?: Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0.
Is there a fix for CVE-2026-61500?: A patch was published on 2026-07-13: Fixed in version 3.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61500 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61500?: Check whether you run Rejetto HFS (HTTP File Server) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Rejetto HFS (versions 3.0.0 to 3.2.0) utilizes the non-cryptographic Math.random() generator to derive its session-cookie signing key. Because the application also discloses outputs from this same generator to unauthenticated clients during the login process, a remote attacker can collect a small number of responses to reconstruct the PRNG state. Once the state is known, the attacker can recover the signing key and forge a valid administrator session cookie. With administrative access, the attacker can leverage the 'server_code' configuration feature to achieve remote code execution (RCE). The vulnerability is addressed in version 3.2.1.

Affected products

Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0

Timeline

2026-07-13: disclosed
2026-07-13: patched: Fixed in version 3.2.1
2026-07-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.