Cyber Resilience

CVE-2026-61500

Public PoC
Published
13 July 2026
Modified
15 July 2026
CVSS Score v4 9.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0075 51th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-61500 is a critical-severity PRNG (CWE-338) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the…

more

generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

CWE(s)
CWE-338

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Weak PRNG and generator leakage directly enable remote session forgery against the public HFS web app, granting admin access and RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-40762Shared CWE-338
CVE-2026-11832Shared CWE-338
CVE-2025-46653Shared CWE-338
CVE-2025-66630Shared CWE-338
CVE-2024-58041Shared CWE-338
CVE-2025-40905Shared CWE-338
CVE-2026-5080Shared CWE-338
CVE-2026-40514Shared CWE-338
CVE-2026-9323Shared CWE-338
CVE-2026-5087Shared CWE-338

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-12 Cryptographic Key Establishment and Management
  • SC-23 Session Authenticity
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.2.3
  • V11.5.1

Mitigating Controls (NIST 800-53 r5) AI

SC-12 Cryptographic Key Establishment and Management good match
prevent

Requires cryptographically strong key generation and establishment, directly preventing use of Math.random() outputs as a session signing key.

SC-23 Session Authenticity good match
prevent

Enforces mechanisms that protect session authenticity, blocking forgery of administrator cookies derived from a reconstructed weak PRNG state.

IA-5 Authenticator Management partial match
prevent

Mandates secure generation and management of authenticators such as session cookies, addressing the disclosure and predictability that enable key recovery.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography mostly match
prevents

Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect use of weak random number generators.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes should catch weak PRNG usage during design and code review.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify cryptographically strong random number generation.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure engineering principles include selection of appropriate cryptographic primitives.

A.8.28 Secure coding partial match
prevents

Secure coding standards prohibit use of weak PRNGs in security contexts.

References