Attackers probe Rejetto HFS flaw that enables administrator session forgery

VulnCheck has observed probes targeting a Rejetto HFS vulnerability that can let attackers forge administrator sessions and execute code on file-sharing servers, BleepingComputer reported. The activity appears to be small-scale reconnaissance from a single China Telecom IP address targeting deployments in Japan and the United States. The flaw, CVE-2026-61500, affects versions 3.0.0 through 3.2.0. Login responses expose outputs from the same weak random-number generator used to create session-signing keys, allowing attackers to recover a key and forge an administrator cookie. HFS can then execute attacker-controlled server-side JavaScript. Version 3.2.1 fixes the vulnerability. VulnCheck has not shared evidence of successful exploitation or activity following a compromise.