Network threat monitoring arrays confirm active global scanning sweeps targeting a high-severity session handling vulnerability in lightweight web file server software. Unauthenticated remote adversaries exploit weak cryptographic signing keys to forge administrative cookies and execute remote code.
The vulnerability, tracked as CVE-2026-61500, affects Rejetto HTTP File Server HFS releases. The defect arises from the use of static or predictable session signing keys within session token generation modules. Unauthenticated remote adversaries transmit forged HTTP authorization headers to bypass authentication logic, obtaining administrative access over target servers and executing arbitrary system commands. Threat telemetry indicates automated botnets actively scanning internet-facing HFS instances to drop crypto-miners and reverse proxies.
Subverting web file server daemons exposes stored enterprise files and host network boundaries. When unauthenticated actors achieve remote code execution on file server hosts, adversaries can exfiltrate sensitive corporate files, deploy secondary malware payloads, and pivot into internal network segments.
– Apply official maintenance security updates across all Rejetto HTTP File Server deployments immediately.
– Restrict public internet access to file management web interfaces by placing hosts behind zero-trust access proxies.
– Inspect HTTP server access logs for unverified administrative session requests or anomalous cookie structures.
– Isolate file server hosting roots on dedicated subnets and restrict outbound network connectivity to untrusted domains.
Web file server security relies on robust cryptographic session signing and strict access control isolation to ensure lightweight file management daemons remain protected from unauthenticated remote takeover. #CodeDefence #Rejetto #HFS #RCE #SessionForgery #WebSecurity #AppSec #ThreatIntelligence
/
