Rejetto HFS session forgery vulnerability exploited in the wild

1. 19:09
   CSA Labs Research

   Anthropic Mythos model discovers Rejetto HFS authentication bypass vulnerability CVE-2026-61500, probed and exploited the day after public disclosure

   Rejetto HFS 3.0.0 through 3.2.0 has an authentication bypass vulnerability, CVE-2026-61500 (CVSS 9.3). Attackers can forge an administrator session and achieve remote code execution; the vendor released HFS 3.2.1 on July 13, 2026 to fix it. The flaw was discovered by Zach Hanley of Horizon3.ai using Anthropic's Mythos model. Mythos identified that a weak random number generator and login output leakage could be chained, and suggested using the Z3 SMT solver to recover the generator's state. Probe attempts appeared within about a day of Horizon3.ai publishing technical details and a PoC video; reported activity so far is small in scale, with no confirmed successful intrusions.

1. 16:09
   The Hacker News

   Rejetto HFS vulnerability CVE-2026-61500 exploited in the wild, can forge admin sessions and achieve RCE

   Rejetto HTTP File Server (HFS) 3.0.0 through 3.2.0 has session forgery vulnerability CVE-2026-61500 (CVSS 9.3): its session cookie signing key is generated by non-cryptographic Math.random(), allowing attackers to collect a small number of login responses to reconstruct the PRNG state, recover the signing key, forge admin sessions, and achieve remote code execution via the server_code configuration. The vulnerability was discovered by Anthropic's Mythos model, fixed in version 3.2.1 in July 2026, with a public Python PoC released at the end of September; VulnCheck detected in-the-wild exploitation attempts against real hosts in the United States on October 1.

Current attention32·Peak in the comparable period37（Oct 8 15:00）·Change over the comparable past 24 hours 0%