Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Security Flaw in Rejetto HFS Could Let Attackers Take Control

A serious security weakness has been found in Rejetto HFS, a file server software used by some small businesses. This flaw could allow attackers to pretend to be administrators and take full control of the server, potentially running harmful software remotely. It is important to check if you use this software and act quickly to protect your organisation.

05 October 2026

Reference: CVE-2026-61500

1. What is being reported?

The vulnerability involves how Rejetto HFS creates and protects login session cookies. The software uses an insecure method to generate keys that protect administrator sessions. Attackers can gather some login information, figure out the key, and then create fake administrator sessions. This lets them access the server fully and run malicious code remotely.

2. What this means in plain English

If your organisation uses Rejetto HFS versions 3.0.0 to 3.2.0, attackers could gain full control over your file server without needing a password. This could lead to data theft, disruption of services, or your systems being used to attack others. For organisations not using this software, this risk does not apply.

3. Could this affect a small business?

Small businesses or charities using Rejetto HFS in the affected versions are at risk. If you do not use this software, or use a different file server, you are unlikely to be affected. It is important to confirm what software your organisation uses.

4. What to do now

  • Check if your organisation uses Rejetto HFS, especially versions 3.0.0 through 3.2.0.
  • If you do use it, contact your software supplier or IT provider immediately for guidance on updates or patches.
  • Limit access to the file server from outside your organisation until the issue is resolved.
  • Monitor your systems for any unusual activity and report concerns to your IT support.

5. Ask your IT provider

Can you confirm if we use Rejetto HFS version 3.0.0 to 3.2.0, and what steps are being taken to protect us from the CVE-2026-61500 vulnerability?

6. Bottom line

If you use Rejetto HFS, act quickly to check and secure your system against this critical vulnerability.

Information based on CISA KEV, NVD and reputable security news reports.

Back to Vulnerability Briefs