Summary
Security researchers have confirmed that internet-exposed Rejetto HFS (HTTP File Server) installations are being actively scanned and exploited for a critical remote code execution vulnerability. Rejetto HFS is a widely deployed lightweight web server used for file sharing, commonly found in small business and home office environments as well as in enterprise environments where individuals have deployed it for ad hoc file sharing. The active scanning confirms that threat actors are systematically targeting internet-exposed HFS installations and organizations should patch or take vulnerable servers offline immediately.
Timeline
| Date | Event |
|---|---|
| October 2026 | Critical RCE vulnerability in Rejetto HFS identified; patch released |
| Oct 6, 2026 | Active scanning and exploitation of vulnerable HFS installations confirmed; BleepingComputer reports |
What Happened
Rejetto HFS is a single-executable HTTP file server that has been in use since the early 2000s. Its simplicity and zero-installation deployment model make it popular for ad hoc file sharing, but also mean it is frequently deployed on internet-facing systems without the network controls that would typically protect enterprise applications. The critical RCE vulnerability allows an unauthenticated attacker who can reach the HFS web interface to execute arbitrary commands on the underlying server. Active scanning indicates that threat actors have developed reliable exploit code and are systematically identifying vulnerable installations across the public internet.
The risk profile for Rejetto HFS deployments is elevated because the software is frequently installed by individuals rather than IT teams, meaning it may not appear in organizational asset inventories and may not be covered by standard patch management processes. Organizations should audit for HFS installations across their networks, including employee workstations and servers, and treat any internet-exposed HFS installation running a vulnerable version as potentially compromised pending forensic review.
Domain Intelligence
rejetto.com — 71.94
rejetto.com scores at 71.94 in the high-trust range. Rejetto is the developer of the affected HFS software. The T5_SPARSE flag indicates limited topology-layer coverage for this small software publisher domain.