Exploitation hits Rejetto HFS vulnerability discovered by AI

The latest development from SecurityWeek highlights the active exploitation of a critical vulnerability in the Rejetto HTTP File Server (HFS). This incident centers on CVE-2026-61500, a flaw that allows attackers to recover the session-cookie signing key. By exploiting this weakness, adversaries can bypass authentication mechanisms and gain administrative access to the affected systems.

The report details the severe consequences of this exploitation vector. Once the signing key is compromised, attackers are able to execute remote code execution (RCE). This level of access enables the takeover of the server, effectively granting the attacker full control over the environment where HFS is deployed. The vulnerability was identified through AI-assisted discovery, marking a notable intersection of automated analysis and security research.

SecurityWeek published the detailed findings regarding this exploitation campaign. Their coverage emphasizes the urgency of the situation due to the active nature of the attacks in the wild. The publication serves as the primary source for the details surrounding the CVE-2026-61500 disclosure and the subsequent realization that attackers are already leveraging this flaw for unauthorized access.

The implications for organizations running Rejetto HFS are significant. Administrative access allows for comprehensive manipulation of file services, while RCE capabilities extend the risk to deeper system compromise. As noted in the source material, the vulnerability is not merely theoretical but is being actively used by threat actors. This active exploitation status underscores the critical need for immediate remediation and configuration auditing for any remaining instances of this software.

Ncerio continuously audits infrastructure configurations to maintain security postures across diverse estates. While this specific report focuses on the Rejetto HFS vulnerability, Ncerio’s platform supports organizations in identifying and correcting configuration weaknesses that could expose them to similar threats. The continuous nature of these audits ensures that emerging vulnerabilities are addressed through robust configuration management practices rather than reactive measures alone.