Affected Systems
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. Version 3.2.1 (released July 2026) contains the patch. All unpatched instances exposed to the internet are at risk.
Exploitation Status
Active exploitation detected starting October 1, 2026. Public PoC exploit released by Alejandro Ramos (aramosf) in late September 2026. VulnCheck observed threat actor from China Telecom IP conducting reconnaissance against vulnerable hosts in the U.S. and Japan. Small-scale activity so far but exploit is publicly available and trivial to execute.
Business Impact
Attackers can forge administrator session cookies by reconstructing the weak PRNG state from unauthenticated login responses, gaining full admin access without credentials. This leads directly to remote code execution via the server_code configuration feature, allowing arbitrary JavaScript execution on the server. HFS is commonly used for file sharing; compromise enables data theft, lateral movement, and malware deployment. This is the second actively exploited HFS vulnerability in two years; previous exploitation (CVE-2024-23692) delivered crypto miners and trojans.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade Rejetto HFS to version 3.2.1 or later on all instances
- Identify all HFS deployments using asset discovery tools and network scans for TCP ports commonly used by HFS (default 80/443 or custom ports)
- Review HFS access logs from September 30, 2026 onward for unusual unauthenticated login attempts or unexpected admin session activity
- If immediate patching is not possible, restrict HFS access to trusted IP ranges via firewall rules or place behind VPN
- Monitor for execution of unexpected JavaScript via server_code configuration and review existing server_code entries for unauthorized modifications