CVE-2026-61500

rejetto hfs

Medium priority: severe, but no known exploitation

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

In the news

• Uso de generador pseudoaleatorio criptográficamente débil en HFS de Rejetto · INCIBE-CERT
• Rejetto HFS servers now actively scanned for critical RCE flaw · BleepingComputer
• Una vulnerabilidad crítica en Rejetto HFS permite falsificar sesiones de administrador y ejecutar código · Una al día
• Exploitation Hits Rejetto HFS Vulnerability Discovered by AI · SecurityWeek
• Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE · The Hacker News