A critical authentication-bypass vulnerability (CVE-2026-61500) in Rejetto HTTP File Server, discovered using Anthropic's Mythos AI bug-hunting model, began being actively exploited within a day of disclosure, with attacks originating from China and proxied US IPs targeting vulnerable hosts in the US and Japan.
Disclosed 3 October 2026 · Record updated 3 October 2026
Active in-the-wild exploitation of an authentication bypass enabling full admin access and remote code execution on vulnerable Rejetto HFS servers; initial activity from a China-based IP targeted hosts in the US and Japan, followed by further exploitation attempts from proxied US IP addresses.
IncidentsA critical authentication bypass in Rejetto HTTP File Server, found with Anthropic's Mythos model, drew real-world attacks the day after disclosure, VulnCheck says.
3 Oct 2026
