Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-61502 Cross-Site Request Forgery in Rejetto HFS 3.0.0 Through 3.2.0 Enables Remote Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-61502
Post summary
The text announces a CVE (CVE‑2026‑61502) describing a CSRF flaw in Rejetto HFS that can lead to remote code execution, without providing code, exploitation, or mitigation details.