Active scanning detected for critical Rejetto HFS vulnerability

Security analysts have observed an increase in automated scanning activity targeting Rejetto HTTP File Server (HFS) deployments worldwide. The scans are seeking to exploit a vulnerability identified as CVE-2026-61500. This flaw is described as arising from a weak signing key within the HFS software. Exploitation of this weakness could permit session forgery, unauthorized account takeover, and remote code execution (RCE) on affected servers.

The scanning campaigns appear to be ongoing as of early October 2026, with exposed HFS instances being identified and targeted. While the activity indicates a significant risk, the availability of verified proof-of-concept code or functional exploit modules has not been confirmed in the current reporting.

The CVE identifier CVE-2026-61500 has been referenced in connection with this issue. However, it is noted that the CVE number falls outside the typical assignment window, and the summary contains date references inconsistent with known public records. As such, the vulnerability details and the extent of active exploitation require independent verification from the Rejetto project or trusted security databases.

Administrators of Rejetto HFS servers are advised to verify their current server version, apply any available updates from the official Rejetto project, and consider restricting network exposure via firewall rules or segmentation until a verified patch is released.