Active Scans Target Rejetto HFS Vulnerability CVE‑2026‑61500

Security analysts have reported a noticeable rise in network scans aimed at Rejetto HFS, a lightweight HTTP file‑sharing server, after the discovery of a critical flaw catalogued as CVE‑2026‑61500.

The defect stems from a weak signing key used by the server to validate client sessions. Exploitation enables an attacker to forge session tokens, seize user accounts and, in the worst case, execute arbitrary code on the host machine.

Rejetto HFS remains popular among small‑scale businesses, hobbyists and home users because of its simplicity and minimal resource footprint. Many installations continue to run legacy versions that still rely on the vulnerable key, making them attractive targets for opportunistic actors.

Data collected from honeypots and internet‑wide scanning platforms show that threat actors are employing automated tools to probe typical HFS ports and look for the specific signature associated with the weak key. The activity is coordinated, suggesting the use of botnets or dedicated scanning infrastructure.

If an exploit succeeds, the compromised server can be turned into a foothold for further intrusion, data theft or ransomware deployment. Similar vulnerabilities in file‑serving software have historically led to rapid, widespread abuse, underscoring the seriousness of the current threat.

The software’s maintainers have issued a patch that replaces the signing key and strengthens the authentication process. Users are advised to upgrade to the latest release, regenerate any custom keys, and limit exposure by disabling remote access when it is not essential.

Experts say the situation will be closely watched as unpatched installations remain in the wild. Continued scanning activity is likely to persist, and organizations that rely on Rejetto HFS are urged to prioritize remediation to avoid becoming part of the next wave of remote‑code‑execution attacks.