CVE-2026-61500Vulnerability

1. “The two vulnerabilities that have witnessed active exploitation efforts are CVE-2026-26980, an SQL injection flaw in Ghost CMS, and CVE-2026-61500, a session forgery flaw in Rejetto HTTP File Server.”

   The Hacker NewsNews7 Oct 2026
   Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws

2. “Se han detectado intentos de explotación activa de CVE-2026-61500.”

   INCIBE-CERTGovernment6 Oct 2026
   Uso de generador pseudoaleatorio criptográficamente débil en HFS de Rejetto

3. “A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment into a much more practical warning for defenders.”

   Security AffairsNews5 Oct 2026
   Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.

4. “…CVE-2026-82312, CVE-2026-78043, CVE-2026-81738 (OpenVPN), CVE-2026-75754 (ASUS Control Center Enterprise), CVE-2026-96659 (Foreman), CVE-2026-61500 (Rejetto HFS), CVE-2026-18167, CVE-2026-18330 (TP-Link Archer AX55 v4), CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-544…”

   The Hacker NewsNews5 Oct 2026
   ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

5. “Tracked as CVE-2026-61500 (CVSS score of 9.3), the flaw exists because the open source file server discloses outputs of its non-cryptographic session cookie generator to unauthenticated clients during login.”

   SecurityWeekNews5 Oct 2026
   Exploitation Hits Rejetto HFS Vulnerability Discovered by AI

6. “The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and seize control of a…”

   The Hacker NewsNews5 Oct 2026
   Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

7. “…searcher Zach Hanley at AI pen-testing company Horizon3 said he used Mythos to uncover a new flaw in the file server, now tracked as CVE-2026-61500.”

   The Register (security)News3 Oct 2026
   Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows

8. “CVE-2026-61500: Rejetto HFS Session Forgery via Predictable Signing Key”

   Horizon3.aiVendor30 Sep 2026
   Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

Also named with it: CVE-2024-23692, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248, CVE-2026-86350, CVE-2026-87022, CVE-2026-76708, CVE-2026-76709, CVE-2026-76710, CVE-2026-91765, CVE-2026-89078, CVE-2026-93577