CVE-2026-61500: Rejetto HFS Session-Key Recovery Under Active Exploitation — Detection and Remediation Guide

---
title: Rejetto HFS Process Spawning Shell or Script Interpreter
id: 8c1e4a92-3b7f-4d51-9a6c-2e8f0b1d7a34
status: experimental
description: Detects the HFS server process spawning command shells or script interpreters, consistent with post-exploitation of CVE-2026-61500 after forged admin session access. HFS has no legitimate reason to spawn cmd.exe, powershell.exe, sh, or bash.
references:
  - https://www.securityweek.com/exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\hfs.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; custom HFS admin plugins invoking scripts. Investigate every hit.
level: critical
---
title: Rejetto HFS Spawning Shell on Linux or macOS
id: 3f7b2d18-6a4c-4e90-b851-9d2c5f7e1a60
status: experimental
description: Detects the HFS server process spawning shells on Linux/macOS hosts, indicative of CVE-2026-61500 post-exploitation command execution.
references:
  - https://www.securityweek.com/exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai/
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/hfs'
      - '/node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Custom admin plugins invoking system commands. Treat every alert as an incident until ruled out.
level: critical
---
title: Suspicious HTTP Requests to HFS Administrative Interface
id: 6d9a3f04-1c8e-4b27-a392-5f0e7c4d9b12
status: experimental
description: Detects inbound requests to HFS admin and API endpoints from external or untrusted sources, consistent with session-cookie forging and admin panel abuse following CVE-2026-61500 key recovery. Tune the uri paths to your HFS version's admin routes.
references:
  - https://www.securityweek.com/exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.valid_accounts
  - attack.t1078
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/~/admin/'
      - '/~/api/'
  filter_listen_port:
    dst-port: 8080
  condition: selection and filter_listen_port
falsepositives:
  - Legitimate admin access from known administrator source IPs. Allowlist your admin subnets explicitly and alert on everything else.
level: high

// Hunt: HFS server spawning child processes (post-exploitation of CVE-2026-61500)
// Windows hosts via Defender for Endpoint
let HfsProcs = dynamic(["hfs.exe", "node.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe",
    "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "net.exe", "net1.exe", "whoami.exe", "nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (HfsProcs)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Linux HFS hosts via Syslog (sudo/exec capture) — look for shells under node/hfs
Syslog
| where TimeGenerated > ago(30d)
| where ProcessName =~ "node" or SyslogMessage has_cs "hfs"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "chmod +x")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Network reconnaissance: inbound connection attempts to HFS default port
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 8080
| where ActionType == "InboundConnectionAccepted"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by RemoteIP, DeviceName
| where ConnectionCount > 50
| order by ConnectionCount desc;

-- Hunt for Rejetto HFS processes and suspicious child processes (CVE-2026-61500)
-- Deploy as a fleet-wide hunt to inventory HFS and flag post-exploitation behavior
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)hfs'
   OR (Name =~ '(?i)node' AND CommandLine =~ '(?i)hfs')
   OR CommandLine =~ '(?i)hfs.*--port'

-- Follow-up: identify any child processes spawned by the HFS process
LET hfs_pids = SELECT Pid FROM pslist() WHERE Name =~ '(?i)hfs'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM hfs_pids)
   AND Name =~ '(?i)(cmd|powershell|pwsh|sh|bash|python|curl|wget|mshta|certutil)'

-- Check for HFS listening on its default port (exposure validation)
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, State
FROM netstat()
WHERE LocalPort == 8080 AND State =~ 'LISTEN'

# CVE-2026-61500 - Rejetto HFS inventory, containment, and verification
# Run elevated. Test in a staging environment before broad deployment.

# --- Step 1: Discover HFS processes and binaries on the host
$hfsProcs = Get-Process | Where-Object { $_.Name -match 'hfs' -or ($_.Name -eq 'node' -and $_.CommandLine -match 'hfs') }
if ($hfsProcs) {
    Write-Host "[!] HFS process detected:" -ForegroundColor Red
    $hfsProcs | Select-Object Id, Name, Path, CommandLine | Format-List
} else {
    Write-Host "[+] No running HFS process found." -ForegroundColor Green
}

# --- Step 2: Check listening ports for HFS (default 8080)
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 80, 443, 8080 } |
    ForEach-Object {
        $owner = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue)
        if ($owner.Name -match 'hfs|node') {
            Write-Host "[!] HFS listening on port $($_.LocalPort) as PID $($_.OwningProcess) ($($owner.Path))" -ForegroundColor Red
        }
    }

# --- Step 3: Retrieve installed HFS version (npm installs)
$npmHfs = npm list -g hfs 2>$null
if ($npmHfs -match 'hfs@') { Write-Host "[*] Installed HFS version: $npmHfs" }

# --- Step 4: CONTAINMENT - block inbound 8080 at the host firewall until patched
# This is a compensating control, NOT a fix. Patch first.
New-NetFirewallRule -DisplayName "CONTAIN-CVE-2026-61500-HFS-8080-Block" `
    -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Block `
    -ErrorAction SilentlyContinue | Out-Null
Write-Host "[*] Inbound TCP 8080 blocked at host firewall (containment). Remove after patching."

# --- Step 5: Audit for child processes spawned by HFS in recent event logs (Sysmon)
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-30) } `
    -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'ParentImage:.*(hfs\.exe|node\.exe)' } |
    Select-Object TimeCreated, Message | Format-List
Write-Host "[*] Sysmon audit complete. Any hits above = investigate as active compromise."

#!/usr/bin/env bash
# CVE-2026-61500 - Rejetto HFS inventory and containment for Linux hosts
set -euo pipefail

# --- Step 1: Find running HFS processes
if pgrep -fa 'hfs' > /dev/null; then
    echo "[!] HFS process detected:"
    pgrep -fa 'hfs'
else
    echo "[+] No HFS process running."
fi

# --- Step 2: Identify listeners on common HFS ports
ss -tlnp | grep -E ':(80|443|8080)\s' | grep -Ei 'hfs|node' || echo "[+] No HFS listener found."

# --- Step 3: Check globally installed npm HFS version
npm list -g hfs 2>/dev/null | grep 'hfs@' || echo "[*] HFS not installed via global npm."

# --- Step 4: Containment - block inbound 8080 via nftables until patched
nft add rule inet filter input tcp dport 8080 drop 2>/dev/null \
    && echo "[*] Inbound TCP 8080 dropped (containment). Remove after patching." \
    || echo "[!] nftables rule failed - apply network-level ACL instead."

# --- Step 5: Check for suspicious children of HFS in audit logs
if command -v ausearch &>/dev/null; then
    ausearch -ts recent -k exec 2>/dev/null | grep -Ei 'hfs|node' | grep -E '/bin/(sh|bash)|curl|wget' \
        && echo "[!] Suspicious child process activity - investigate immediately."
fi
echo "[*] Complete. Patch HFS to the fixed release and rotate all secrets."