EP. 174: Rejetto HFS CVE-2026-61500 Exploited for Admin Access and Remote Code

The Digital Warfare Podcast · Oct 5, 2026 · 4m · transcript

Summary

Threat actors are now exploiting CVE-2026-61500, a critical vulnerability affecting Rejetto HTTP File Server versions 3.0.0 through 3.2.0.

The vulnerability results from HFS using the non-cryptographic JavaScript Math.random() generator for its session-cookie signing key while exposing outputs from the same pseudo-random number generator through unauthenticated login interactions.

An attacker can collect several login responses, reconstruct the generator’s state, recover the cookie-signing key and forge a valid administrator session. Administrative access can then be converted into…