CVE-2026-61500: Rejetto HFS Under Attack — What Sysadmins in Spain Must Do Now

A critical flaw in Rejetto HFS is being exploited in the wildSystem administrators across Catalonia and the rest of Spain are once again reminded that...

A critical flaw in Rejetto HFS is being exploited in the wild

System administrators across Catalonia and the rest of Spain are once again reminded that even lightweight file servers can become a gateway to full compromise. Rejetto HTTP File Server (HFS), a tool often chosen for its simplicity, is affected by a critical vulnerability tracked as CVE-2026-61500. The flaw allows an unauthenticated remote attacker to forge an administrator session and, from there, execute arbitrary code on the server. Exploitation attempts have already been observed against internet-facing instances, making patching a priority rather than a routine task.

How the vulnerability works

The root cause lies in how HFS generates the key used to sign session cookies. Instead of relying on a cryptographically secure generator, the software uses JavaScript Math.random(), a general-purpose PRNG that was never designed for security. During the login flow, enough output from that generator is exposed for a patient attacker to reconstruct its internal state after observing a small number of responses. Once the state is known, the signing key is no longer a secret.

From that point, the attack chain unfolds almost automatically. With a forged administrator session, the attacker can reach configuration options that enable server-side JavaScript execution. The server_code functionality effectively turns a session forgery into a clear case of remote code execution (RCE). The issue is classified under CWE-338, the use of a cryptographically weak PRNG, and carries a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8 — both firmly in critical territory.

Affected versions and the race against time

HFS versions 3.0.0 through 3.2.0 are vulnerable. The vendor has addressed the problem in HFS 3.2.1. The timeline leaves little room for delay: a proof-of-concept in Python circulated in late September, lowering the barrier for opportunistic attacks, and by 1 October 2026 exploitation attempts were detected against exposed systems. The activity has been linked to an unidentified actor, underscoring that this is not a theoretical risk.

For organisations in Barcelona, Lleida, Tarragona or Girona running HFS on public IPs, the first step is to inventory every instance and determine which versions are in use. Instances in the 3.0.0–3.2.0 range should be treated as compromised until proven otherwise.

Immediate actions for administrators

Update to HFS 3.2.1 or later as soon as possible. If the server is exposed to the internet, treat this as an emergency change.
Restrict the admin interface and API to trusted networks. Segment management access so that it is never reachable from the public internet.
Review authentication logs for unusual login flows and for calls to sensitive endpoints such as get_config and set_config.
Rotate credentials if compromise is suspected. An administrator session can be used to make persistent changes, so patching alone is not enough.
Verify system integrity and inspect configuration files for unauthorised modifications.
Consider robust signing keys via COOKIE_SIGN_KEYS as a temporary containment measure, but never as a substitute for the patch.

Why perimeter hardening is not enough

This incident illustrates a pattern that repeats across Spanish SMEs and hosting providers: a single weak component, often deployed quickly and forgotten, becomes the entry point for a full breach. Under GDPR, a compromise of this nature can trigger notification obligations to the Spanish data protection authority (AEPD) if personal data is affected, with potential fines running into tens of thousands of euros. The cost of an incident — forensic analysis, downtime, legal advice and reputational damage — dwarfs the effort required to patch a file server.

Beyond patching, the real lesson is that server security must be layered. Firewalls and segmentation help, but they do not stop an attacker who already has a valid session cookie. What stops them is detecting and blocking malicious behaviour at the host level, consistently across every machine you manage.

Centralised protection with Abuse Shield

This is where Abuse Shield from ALMC.es fits naturally. Instead of configuring fail2ban separately on each server and hoping nothing slips through, Abuse Shield centralises protection across your entire fleet. It automatically blocks malicious IPs, manages fail2ban across multiple machines and shares an IP reputation feed between all your servers. When one instance detects an abusive source, the others learn about it immediately.

For system administrators, hosting companies and SMEs with their own infrastructure, this means fewer blind spots and a faster response to attacks like the one targeting HFS. Combined with timely patching and strict access controls, a shared reputation feed turns isolated servers into a coordinated defence. In a landscape where critical vulnerabilities are exploited within days, that coordination is no longer a luxury — it is a baseline requirement for anyone responsible for servers in Spain.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.