# Critical Rejetto HFS flaw (CVSS 9.3) under active exploitation — how to protect your business > Rejetto HFS 3.0.0–3.2.0 has a critical flaw (CVE-2026-61500, CVSS 9.3) being actively exploited in targeted attacks. Update to 3.2.1 now. URL: https://pgtechcorp.com/en/rejetto-hfs-critical-flaw-cve-2026-61500/ Actualizado: 2026-10-06 --- If you share files with **HFS (HTTP File Server)**, this affects you. Many small offices use it to share documents among colleagues or with clients: it is free, lightweight, and installs in a couple of clicks. That is exactly why it became a target: a **critical flaw (CVE-2026-61500, severity 9.3 out of 10)** just appeared in the program and is already being **actively exploited**, letting an attacker take full control of the machine it runs on. The key point: **this is not a random mass attack — it is targeted**, precisely the kind that hunts the SMB that left it open «to make things easier». And the fix is simple: update to version **3.2.1**. ## What is HFS and why is it a risk for an SMB? HFS is a free file server for Windows widely used to share documents in small offices without setting up complex infrastructure. **The detail that makes it dangerous:** so that outside users can download files, many people leave it **exposed to the internet** with the default configuration. In that scenario, any flaw in HFS leaves the door open to anyone in the world. ## What the CVE-2026-61500 flaw does The flaw comes down to a dangerous chain: a predictable session, a forged administrator, and remote code execution. ### Affected versions: 3.0.0 through 3.2.0 The issue affects HFS versions **3.0.0 through 3.2.0**. Earlier and later versions are not in the affected range. ### What happens: a predictable administrator session HFS generates the administrator session identifier in a **predictable** way. An attacker can **forge the administrator session** without a username or password. ### Consequence: remote code execution (full control) Once in as administrator, they **execute code at will** on the machine (remote code execution, RCE). In other words, full control of the server and everything it shares. **Severity:** 9.3 out of 10 (critical). It is **already being exploited** in targeted attacks. Note on the case: the flaw was discovered with the help of an AI (Mythos, by Anthropic) — a sign that the pace of vulnerability discovery has accelerated. **Fix:** update to HFS **3.2.1** (or later). ## Is your business exposed? Quick checklist - **Do you have HFS installed?** It often happens that someone installed it years ago and no one remembers. It is worth checking. - **Is it reachable from the internet?** If it has a port open to the outside, the risk is real (even if you do not use it often). - **Is it on version 3.0.0–3.2.0?** If so, you are in the affected range. - **Is there any strange activity?** Administrator sessions you do not recognize, new files, or unusual processes. This case confirms a deeper trend: AI now finds flaws faster than human teams, and attackers exploit them within days. What it means for your business and how to protect yourself — read [Cybersecurity for Panamanian SMBs: AI now finds vulnerabilities before you do](/en/cybersecurity-ai-smb-panama/). ## What to do right now - **Update to 3.2.1** as soon as possible. It is the official fix. - **If you cannot update yet**, cut internet access: keep it only on the internal network or behind a VPN. - **Check the machine** for signs someone already got in (logs, accounts, files). - **Over the medium term, remove the risk:** instead of a loose file server on a PC, use a **managed file solution** with backup, access control, and monitoring — so the problem does not come back on its own. ## Frequently Asked Questions ### Does it affect me if I do not use HFS? No. The flaw is specific to HFS 3.0.0–3.2.0. If you do not have it installed, it does not apply. ### Does updating delete my files? No. Updating to 3.2.1 replaces the program; your files and folders stay in place. ### What if I do not know whether I have it installed? That is very common. The fastest route is to review your machines and exposed ports to see what is there and what was left open. ### Why is an SMB a target? Because attackers go for the easy targets: small servers, left open and unpatched. A compromised machine can be used to demand ransom, steal information, or jump to other systems. [Book your consultation](https://wa.me/50769606453) *Sources: GitHub Advisory Database (GHSA-xxrm-3f86-v97j / CVE-2026-61500), The Hacker News, and Horizon3.ai.* --- PG Tech Corporation, Inc. — Obarrio, Ave. Samuel Lewis, PH Marfil, Ciudad de Panama, Panama Contacto: WhatsApp 6960-6453 · https://pgtechcorp.com