Affected Systems
Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 on Windows, Linux, and macOS. Fixed in version 3.2.1; latest stable is 3.3.4.
Exploitation Status
Active exploitation confirmed. VulnCheck honeypots observed scanning activity from China Telecom IP targeting deployments in Japan and the United States. Public PoC exploit available since September 30, 2026 (Horizon3). Activity appears to be small-scale reconnaissance at this time.
Business Impact
Attackers can forge administrator session cookies by recovering the weak signing key derived from Math.random(). This leads to full administrative access and remote code execution via the server_code configuration feature. Impact includes unauthorized file access/theft/deletion, malware installation, and potential pivot to internal systems. Self-hosted file-sharing servers are at risk, particularly those exposed to the internet.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade Rejetto HFS to version 3.2.1 or later (3.3.4 is the current stable release)
- Identify all Rejetto HFS instances in your environment, especially internet-facing deployments on Windows, Linux, and macOS
- Review HFS access logs for suspicious login attempts or session activity between July 13 and present, particularly from China Telecom IP ranges
- Rotate all administrator credentials and invalidate existing sessions after patching
- If immediate patching is not possible, restrict HFS access to trusted IP ranges or take servers offline until remediation