If your business runs a Rejetto HTTP File Server — even an old, forgotten instance — you need to read this. Security researchers have confirmed that attackers are now actively scanning the internet for servers affected by a critical remote code execution flaw in Rejetto HFS. That means automated tools are probing networks right now, looking for a door left unlocked. For small and medium businesses, this is exactly the kind of threat that slips under the radar until something goes very wrong.
What Is the Rejetto HFS RCE Flaw and Why Does It Matter?
Rejetto HFS (HTTP File Server) is a lightweight file-sharing tool that many small businesses and IT teams have used over the years to quickly share files over a local network or the internet. The problem is that older versions contain a critical remote code execution vulnerability — RCE for short. RCE means an attacker can run their own commands on your server without ever having a password or physical access. They just need to find the server.
What makes this particularly dangerous right now is the shift from theoretical risk to active exploitation. When a vulnerability moves from "known flaw" to "actively scanned," the window between exposure and attack compresses dramatically. Threat actors use automated scanning tools that sweep millions of IP addresses in hours. If you have a vulnerable Rejetto instance sitting on your network — even one nobody has thought about in two years — it can be found and compromised faster than your IT team can respond.
Who Is Actually at Risk Here?
This is where SMB owners sometimes tune out, assuming this kind of thing only affects large enterprises. That assumption is exactly what attackers count on. Small and medium businesses often run legacy software longer than larger organisations because they lack dedicated security teams doing regular audits. A file server set up years ago by a contractor or a former IT employee can easily be forgotten but remain internet-accessible.
Beyond the server itself, the downstream risk is what keeps security professionals up at night. A compromised server can become a foothold into your wider network. From there, attackers can harvest credentials, install malware, exfiltrate customer data, or deploy ransomware. Stolen credentials from compromised systems frequently end up in infostealer logs traded on dark web markets and Telegram channels — sometimes within hours of an initial breach. By the time your business discovers the intrusion, your employee or customer data may already be circulating in places you cannot see without the right monitoring tools.
What You Should Do Right Now
The immediate priority is to find out whether your organisation is running any version of Rejetto HFS — particularly versions prior to the patched release. Ask your IT team or managed service provider to audit all externally accessible services. If you find a vulnerable instance, the options are straightforward: update to the latest patched version if the software is still needed, or shut it down entirely if it is not actively being used. An unused server with no patch is a liability with no upside.
Beyond this specific fix, this incident is a good prompt for a broader conversation about shadow IT — software and servers running in your organisation without central oversight. These forgotten systems are disproportionately responsible for successful breaches at SMBs, not because attackers are sophisticated, but because the targets are simply not being watched.
You should also think about what happens after a potential compromise. Even if you patch immediately, there is no guarantee that your server was not already accessed during the window it was vulnerable. Checking whether any credentials or data tied to your business domains have appeared in breach databases, infostealer dumps, or dark web markets is a critical next step that many businesses skip entirely.
The Broader Lesson for SMB Security
The Rejetto HFS RCE flaw is a reminder that the most dangerous threats to small businesses are rarely the headline-grabbing zero-days targeting banks and governments. They are old, unpatched software sitting quietly on a network, waiting to be found by an automated scanner. Staying ahead of that requires both good software hygiene and continuous visibility into what exposure you already have.
At Breachrr, we monitor breach databases, infostealer dumps, dark web markets, public code repositories, and your domain infrastructure to surface exactly this kind of hidden risk before it becomes a headline. If you want to know what attackers can already see about your business, run a free audit at breachrr.com/audit — it takes minutes and the results often surprise people.
Want to see if your company is exposed?