Attackers began probing and exploiting a newly disclosed critical flaw in Rejetto HTTP File Server (HFS), putting exposed file-sharing servers at immediate risk. The bug, CVE-2026-61500, is an authentication-bypass vulnerability in HFS 3.x that can lead to full administrator access and remote code execution; users should update to HFS v3.2.1 or later. Researchers said exploitation was first seen from a China-hosted IP against vulnerable hosts in the US and Japan within a day of disclosure.
Why it matters: Organizations running internet-exposed Rejetto HFS servers may be vulnerable to full server takeover right now. This is urgent: defenders should identify HFS instances, update to 3.2.1 or later immediately, and review logs for suspicious access attempts.
Bill Toulas
2026.10.05
94% relevant
This article advances the same CVE-2026-61500 story by adding evidence of active reconnaissance in the wild: VulnCheck honeypots saw scanning from a China Telecom IP against Rejetto HFS deployments in Japan and the United States after Horizon3 published technical details and a proof of concept.
Ionut Arghire
2026.10.05
98% relevant
This source directly updates the same event by adding technical detail on how CVE-2026-61500 works, confirming active exploitation, noting the July 13 fix in HFS 3.2.1, and citing VulnCheck reconnaissance from a China Telecom IP hitting canaries in Japan and the US.
info@thehackernews.com (The Hacker News)
2026.10.05
95% relevant
This article appears to cover the same underlying Rejetto HFS exploitation event, adding that attackers are targeting a flaw that enables forged administrator sessions and follow-on remote code execution against exposed HFS servers.
2026.10.03
100% relevant
This article establishes the story by tying a newly disclosed HFS flaw, CVE-2026-61500, to active exploitation in the wild almost immediately after public disclosure.
← Back to all stories