What’s being scanned and why it matters
VulnCheck’s Canary Intelligence honeypots logged inbound traffic that tried to exploit CVE‑2026‑61500, a session‑cookie signing weakness in Rejetto HFS versions 3.0.0‑3.2.0. The scans came from a single China Telecom address and hit servers in Japan and the United States.
Technical details of the flaw
The bug lies in how Rejetto HFS signs its session cookies. An attacker who can forge a valid cookie can impersonate any user and, through the server_code configuration option, trigger arbitrary code execution on the host. Horizon3 published a proof‑of‑concept on September 30 2026 that demonstrates this remote code execution path.
Impact if exploited
Successful exploitation would let an adversary run commands, potentially read, modify or delete files, or use the compromised host as a foothold inside a network. No real‑world incidents have been reported yet.
Who’s affected
Any installation of Rejetto HFS version 3.0.0 through 3.2.0 on Windows, Linux or macOS is vulnerable. The software is widely used for lightweight file sharing, so a broad range of small businesses and hobbyist setups may be exposed.
Defensive steps
All operators should apply the vendor‑released fix immediately.
- Upgrade to Rejetto HFS 3.2.1 or later (current stable 3.3.4).
- Verify the version number in the server’s
hfs.inior UI. - Block inbound traffic from the observed China Telecom IP address at the perimeter if possible.
- Monitor logs for unusual
server_coderequests or malformed session cookies. - Consider disabling the
server_codefeature if it’s not required for your use case.
Outlook
The public proof‑of‑concept has already attracted automated scanning. Until more data appears, the safest posture is to patch and keep an eye on network traffic for similar patterns.