Today’s Field Note

Three patch-now items surfaced today, and one is already past the theoretical stage. Attackers are actively scanning for CVE-2026-61500 in Rejetto HFS, a weak signing key flaw that enables session forgery, account takeover, and RCE. Scanning is the warmup; HFS boxes tend to sit exposed and forgotten, which is exactly the profile that gets owned. Alongside that, Atlassian disclosed CVE-2026-21589 (CVSS 9.3), an unauthenticated file read across eight self-hosted Data Center products, and Microsoft pushed an out-of-band fix for CVE-2026-96940, a weak-authorization privilege escalation in Exchange Server that lets an authenticated attacker reach other users’ mailboxes. None of these need novel tradecraft. They need you to still be unpatched.

Today’s Action

  • Patch or take offline any internet-facing Rejetto HFS instance now; rotate signing keys and invalidate sessions after CVE-2026-61500 remediation.
  • Inventory self-hosted Atlassian Data Center products (Jira, Confluence, et al.) and apply the CVE-2026-21589 fix; restrict web root exposure where patching lags.
  • Apply Microsoft’s out-of-band update for CVE-2026-96940 on Exchange Server, prioritizing externally reachable and admin-adjacent accounts.
  • Pull web logs on HFS and Atlassian hosts for anomalous requests to known file paths and forged-session activity predating the patch.
  • Confirm no leftover exposed HFS servers exist via external scan; the forgotten ones are the ones that bite.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

File it, patch it, forget you ever had free time.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.