Rejetto HFS Servers Targeted by Active Scans for RCE Flaw

Rejetto HTTP File Server (HFS) instances are currently under active scanning by malicious actors searching for a critical remote code execution (RCE) vulnerability. This flaw, identified as CVE-2026-61500, stems from a weak signing key implementation within the server software. The exploitation of this vulnerability allows attackers to forge user sessions, leading to unauthorized account takeovers. Furthermore, the RCE capability means attackers could potentially execute arbitrary code on the compromised server, granting them full control over the affected system.

The vulnerability was disclosed by security researchers who highlighted the severity of the weak signing key. This key is instrumental in verifying the integrity and authenticity of data exchanged between the server and its clients. When this key is weak, it becomes susceptible to cryptographic attacks, enabling an attacker to manipulate session tokens or other authentication mechanisms. The implications are significant, as a successful exploit could lead to data breaches, the deployment of malware, or the use of the compromised server for further malicious activities, such as launching distributed denial-of-service (DDoS) attacks.

Rejetto HFS is a popular, lightweight web server often used for simple file sharing and hosting. Its ease of use and minimal resource requirements have made it a choice for individuals and small businesses. However, this widespread adoption also makes it an attractive target for attackers seeking to exploit common vulnerabilities. The active scanning indicates that threat actors are actively attempting to identify and exploit vulnerable HFS installations in the wild, posing an immediate risk to users of the software.

Security advisories urge all users of Rejetto HFS to update their software to the latest version or to implement immediate mitigation strategies. While a specific patch version was not detailed in the initial reports, the general recommendation is to apply any available security updates provided by the vendor. For those unable to update immediately, disabling features that rely heavily on the weak signing key or restricting network access to the HFS server can serve as temporary workarounds. The ongoing scanning underscores the importance of prompt patching and robust security practices for all internet-facing services.