Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Anthropic expands vetted Claude cyber access after Glasswing verified 129,000 software flaws.
78
CVE-2026-61500
- CVSS 4.0
- 9.3 critical
- EPSS
- 2%p80
- Published
- ·
- Modified
Description · NVD
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
- Weakness
- CWE-338
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
8 storiesAttackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Attackers are exploiting Rejetto HFS CVE-2026-61500 to forge admin sessions and gain remote code execution.
78
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
Attackers are exploiting CVE-2026-61500, a critical Rejetto HFS authentication-bypass and code-execution flaw found with Anthropic Mythos.
76
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
Attackers are exploiting Rejetto HFS flaw CVE-2026-61500 to forge admin cookies and gain code execution.
76
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are scanning Rejetto HFS for CVE-2026-61500, a critical flaw enabling admin session forgery and RCE.
74
Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows
Attackers are exploiting CVE-2026-61500, a critical Rejetto HFS auth bypass discovered by Anthropic’s Mythos.
74
Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code
Anthropic's Mythos AI found critical Rejetto HFS flaw CVE-2026-61500, letting attackers forge admin sessions and achieve remote code execution via predictable session keys.
65
Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS
Horizon3 used Anthropic's Mythos model to discover CVE-2026-61500 in Rejetto HFS 3.x, a session-forgery flaw enabling unauthenticated remote code execution.
56