Rejetto HFS CVE-2026-61503

No special conditions are required for the enumeration phase: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the HFS login endpoint needs only to be reachable over the network by the attacker, with no authentication, user interaction, or non-default configuration required. The default HFS deployment exposes this endpoint. Exploitation impact is bounded to reconnaissance-valid username disclosure only, with no direct credential or data exposure. The attack is most consequential when the default admin account name is in use (standard HFS behavior) and when no external rate-limiting, WAF, or IP allowlisting is applied to the login endpoint. HFS instances isolated from untrusted networks or protected by a reverse proxy requiring prior authentication are not practically at risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately reflects a remotely exploitable, zero-prerequisite flaw with limited, one-dimensional confidentiality impact. The 6.9 score is appropriate in isolation. However, the vendor's own release notes elevate real-world concern by noting that the bundled vulnerabilities in v3.2.1 collectively 'potentially allow an attacker to gain administrative access'-meaning this enumeration flaw should be evaluated in context of its chaining potential, not solely on its standalone CVSS score. No EPSS data is provided in the input and cannot be confirmed. No CISA KEV listing exists and no public exploit code has been identified at time of analysis, so exploitation remains unconfirmed. Risk is highest for internet-exposed HFS instances using default admin account names with weak password controls and no login rate-limiting.

An attacker sends automated HTTP POST requests to the HFS login endpoint cycling through a wordlist of common usernames and observes differing response codes, body text, or response timing to identify valid accounts including the default admin. With the admin username confirmed, the attacker proceeds to credential-stuffing using leaked password databases or targeted brute-force, and-given the vendor's disclosure of co-remediated vulnerabilities-may chain this with additional unpatched HFS flaws to achieve full administrative access. No public exploit code is identified at time of analysis, but the enumeration technique is trivial to implement with standard HTTP tooling.