Is CVE-2026-61500 actively exploited?

No active exploitation of CVE-2026-61500 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-61500 be exploited remotely?

Yes. CVE-2026-61500 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-61500?

CVE-2026-61500 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-61500

CRITICAL

CVE-2026-61500

CWE-338Published: July 13, 2026· Updated: Jul 15, 2026

9.8

CVSS v3.1

EPSS:0.75%probability of exploitation in 30 daysPercentile:50.6th

Official Description

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

NVD Source

Risk Analysis

This critical vulnerability in Rejetto HFS allows a remote attacker to forge an administrator session cookie, leading to full administrative access and remote code execution. With a CVSS score of 9.8, this flaw poses an extremely severe risk to the confidentiality, integrity, and availability of the system. There is no EPSS score to indicate exploitation likelihood, and it is not listed in CISA's KEV catalog.

No public exploit is known for this vulnerability. It is remotely exploitable with low attack complexity, meaning an attacker can exploit it over a network without special conditions.

Recommended Action

Upgrade Rejetto HFS to a version beyond 3.2.0 to address the insecure session-cookie signing key generation. Ensure that cryptographic randomness is used for all security-sensitive operations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-61500 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.