CVE-2026-61500 rejetto CVE debrief

Who should care

Administrators and users of Rejetto HFS versions 3.0.0 through 3.2.0 should be aware of this critical vulnerability, as it allows remote attackers to forge valid administrator session cookies, leading to full administrative access and remote code execution. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Technical summary

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature. The vulnerability's impact on confidentiality, integrity, and availability should be reviewed.

Defensive priority

High

Recommended defensive actions

• Immediately upgrade to Rejetto HFS version 3.2.1 or later
• Implement additional monitoring and logging to detect potential exploitation attempts
• Restrict access to the HFS server to only trusted users and networks
• Consider implementing a web application firewall (WAF) to detect and prevent suspicious traffic
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and analysis are required to fully understand the impact and potential mitigations. Affected product deployments should be identified, and owners assigned for follow-up. The vulnerability's impact on confidentiality, integrity, and availability should be reviewed. Additional monitoring and logging may be necessary to detect potential exploitation attempts. The Math.random() generator's use in deriving the session-cookie signing key is a concern. Limited evidence is available to confirm the vulnerability's scope and severity.

Official resources