- Published
- Source
- Security Affairs
- Filed under
- AI attacks, Malware & exploits
- Vulnerabilities
- 1 CVE
AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild. A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment…
Using AI safely
- Know which AI tools your organisation uses, and what data goes into them.
- Treat AI agents like any other identity: least privilege, logging and a named owner.
- Test AI features for prompt injection and data leakage before customers reach them.
More helpNCSC: guidelines for secure AI system development (opens in a new tab)
The vulnerabilities in this story
CVE-2026-61500 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Exploit Public-Facing Application
Initial AccessWhat a defender checks
- Find every internet-facing instance of the affected product.
- Patch, or apply the vendor's mitigation now – CISA's KEV list gives a deadline.
- Look for signs it was exploited before you patched: web shells, new accounts, odd outbound traffic.
Build the skillBlue Team Analyst · Vulnerability Management
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
AI security · in both programmes
AI is part of the attack surface now. Learn to watch it.
Blue Team Analyst covers Security Copilot in triage and monitoring the AI itself: inherited permissions, prompt injection and Purview DSPM for AI. Blue Team Engineer secures the deployment: Copilot pre-flight hardening, agent identity and tool allow-lists.
- Security Copilot in triage
- Prompt injection and DSPM for AI
- Agent identity and allow-lists
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
