CVE-2026-61500 Active Exploitation Detected Day After Public PoC for Rejetto HFS PRNG Session Forgery

VulnCheck observed the first probes 24 hours after Horizon3.ai and researcher Alejandro Ramos published details of the flaw. The vulnerability stems from Rejetto HFS deriving its Koa session signing key from JavaScript's non-cryptographic Math.random() while exposing PRNG outputs during unauthenticated SRP login responses. An attacker collecting a handful of responses can recover the generator state, sign a valid administrator cookie, and reach the server_code endpoint for arbitrary JavaScript execution and full remote code execution.

The evidence trail shows small-scale reconnaissance rather than mass scanning. A single IP tied to China Telecom tested hosts in Japan and the United States. This follows the July 2026 patch in version 3.2.1, yet public weaponization waited until late September when the PoC surfaced. The pattern mirrors CVE-2024-23692, which saw multiple actors deploy miners and HATVIBE malware after its disclosure.

Anthropic's Mythos model assisted initial discovery at Horizon3.ai, highlighting how AI-assisted code review can surface predictable PRNG usage in authentication paths. The gap between patch availability and PoC release created a three-month window that defenders largely ignored until exploitation telemetry appeared.

Unpatched HFS instances remain exposed to rapid follow-on campaigns. Organizations should prioritize version 3.2.1 deployment and monitor for anomalous login responses that leak PRNG outputs. Similar weak random sources in other file servers warrant immediate audit.