Critical Rejetto HFS flaw (CVSS 9.3) under active exploitation — how to protect your business
If you share files with HFS (HTTP File Server), this affects you. Many small offices use it to share documents among colleagues or with clients: it is free, lightweight, and installs in a couple of clicks. That is exactly why it became a target: a critical flaw (CVE-2026-61500, severity 9.3 out of 10) just appeared in the program and is already being actively exploited, letting an attacker take full control of the machine it runs on.
The key point: this is not a random mass attack — it is targeted, precisely the kind that hunts the SMB that left it open «to make things easier». And the fix is simple: update to version 3.2.1.
What is HFS and why is it a risk for an SMB?
HFS is a free file server for Windows widely used to share documents in small offices without setting up complex infrastructure.
The detail that makes it dangerous: so that outside users can download files, many people leave it exposed to the internet with the default configuration. In that scenario, any flaw in HFS leaves the door open to anyone in the world.
What the CVE-2026-61500 flaw does
The flaw comes down to a dangerous chain: a predictable session, a forged administrator, and remote code execution.
Affected versions: 3.0.0 through 3.2.0
The issue affects HFS versions 3.0.0 through 3.2.0. Earlier and later versions are not in the affected range.
What happens: a predictable administrator session
HFS generates the administrator session identifier in a predictable way. An attacker can forge the administrator session without a username or password.
Consequence: remote code execution (full control)
Once in as administrator, they execute code at will on the machine (remote code execution, RCE). In other words, full control of the server and everything it shares.
Severity: 9.3 out of 10 (critical). It is already being exploited in targeted attacks. Note on the case: the flaw was discovered with the help of an AI (Mythos, by Anthropic) — a sign that the pace of vulnerability discovery has accelerated.
Fix: update to HFS 3.2.1 (or later).
Is your business exposed? Quick checklist
- Do you have HFS installed? It often happens that someone installed it years ago and no one remembers. It is worth checking.
- Is it reachable from the internet? If it has a port open to the outside, the risk is real (even if you do not use it often).
- Is it on version 3.0.0–3.2.0? If so, you are in the affected range.
- Is there any strange activity? Administrator sessions you do not recognize, new files, or unusual processes.
This case confirms a deeper trend: AI now finds flaws faster than human teams, and attackers exploit them within days. What it means for your business and how to protect yourself — read Cybersecurity for Panamanian SMBs: AI now finds vulnerabilities before you do.
What to do right now
- Update to 3.2.1 as soon as possible. It is the official fix.
- If you cannot update yet, cut internet access: keep it only on the internal network or behind a VPN.
- Check the machine for signs someone already got in (logs, accounts, files).
- Over the medium term, remove the risk: instead of a loose file server on a PC, use a managed file solution with backup, access control, and monitoring — so the problem does not come back on its own.
Frequently Asked Questions
Does it affect me if I do not use HFS?
No. The flaw is specific to HFS 3.0.0–3.2.0. If you do not have it installed, it does not apply.
Does updating delete my files?
No. Updating to 3.2.1 replaces the program; your files and folders stay in place.
What if I do not know whether I have it installed?
That is very common. The fastest route is to review your machines and exposed ports to see what is there and what was left open.
Why is an SMB a target?
Because attackers go for the easy targets: small servers, left open and unpatched. A compromised machine can be used to demand ransom, steal information, or jump to other systems.
Sources: GitHub Advisory Database (GHSA-xxrm-3f86-v97j / CVE-2026-61500), The Hacker News, and Horizon3.ai.
