> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - URL: https://f4n6.co.uk/security-feed/ahsaycbs-flaws-exploited-to-deploy-web-shells-get-new-fixes-after-incomplete-patches/ - Published: 2026-10-15T11:46:47.000Z - Updated: 2026-10-15T11:46:47.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-105133, CVE-2026-105134 ## 1\. Executive summary Ahsay has released new fixes for two AhsayCBS flaws, CVE-2026-105133 (CVSS 5.5 MEDIUM, CWE-287) and CVE-2026-105134 (CVSS 9.3 CRITICAL, CWE-77/CWE-78), after earlier patches proved incomplete. Both are in CISA KEV (added 2026-10-14) and are being chained in the wild to bypass authentication and execute OS commands, dropping web shells and XMRig miners. CVE-2026-105134 is the critical item: remote command execution via the Replication Receiver endpoint, with a KEV remediation due date of 2026-10-17\. Any EMEA financial services firm running an internet-exposed AhsayCBS instance is exposed now; the two-day KEV window leaves little room for a normal change cycle. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | A chained authentication-bypass and OS command injection flaw in a backup product, exploited in the wild, requires a defined ICT-related incident management process to detect, contain and remediate. | Incident response runbooks must cover the AhsayCBS chain, including web shell hunting and miner removal, not just the patch. | | DORA Art. 19 | CVE-2026-105134 is CRITICAL and in CISA KEV with a 2026-10-17 due date; exploitation of a backup system can meet the major-incident reporting threshold. | If exploitation is confirmed, the reporting clock to the competent authority starts; classification under Art. 18 must be done first. | | NIS2 Art. 21(2)(d) | AhsayCBS is a third-party backup product; the exploited flaws sit in a supplier component, engaging supply chain security measures. | Supplier risk assessment and contractual security requirements for the backup provider must be reviewed. | ## 3\. Technical analysis & attack chain The two flaws are designed to be chained. CVE-2026-105133 bypasses authentication; CVE-2026-105134 then executes arbitrary OS commands. Neither is useful alone against a hardened target, but together they give an unauthenticated remote attacker command execution on the AhsayCBS host. Confirmed steps, from the NVD/CISA KEV entries and vendor reporting: 1. The attacker reaches the AhsayCBS API component and manipulates the `random` parameter in the `checkSysPwd` function to bypass authentication (CVE-2026-105133, CWE-287). The vulnerable code is in `com/ahsay/obs/api/ApiStructsAction.java`. 2. With authentication bypassed, the attacker sends a request to the Replication Receiver component endpoint `/rps/api/json/UpdateReceivers.do`, again manipulating the `random` parameter, to inject and execute OS commands (CVE-2026-105134, CWE-77/CWE-78). 3. Command execution is used to drop web shells, giving persistent remote access to the host. 4. The same access is used to deploy XMRig cryptocurrency miners, which the reporting says are disguised as Microsoft Edge. The initial access vector is the exposed AhsayCBS service itself. There is no separate phishing or credential-theft step in the sources; the authentication bypass is the entry point. Persistence is via the dropped web shell. The sources do not describe lateral movement, command-and-control infrastructure, or data exfiltration, and none should be assumed. **Discrepancy note:** the source describes CVE-2026-105133 as an improper authentication flaw in `checkSysPwd()`, which matches the verified CWE-287 classification. No conflict there. The verified CVSS for CVE-2026-105133 is 5.5 MEDIUM; the source quotes the same 5.5 figure. The verified CVSS for CVE-2026-105134 is 9.3 CRITICAL, and the source does not quote a competing score. **Confidence caveat:** the specific exploitation detail (web shells, XMRig disguised as Edge, the exact endpoint and parameter) rests on the Huntress report and The Hacker News coverage. The CVE identifiers, CVSS scores, CWE classifications and KEV status are corroborated by NVD/CISA. Treat the malware-capability detail as single-sourced until a second vendor confirms it. ## 4\. Mitigation & containment ### P1 (within 24h) - Patch AhsayCBS to 10.3.4, the version named in the Huntress reporting. This is the vendor fix for both CVEs. - If 10.3.4 cannot be applied immediately, take the AhsayCBS instance off the internet. The KEV due date is 2026-10-17; an exposed, unpatched instance is the exposure. - Hunt for web shells on any AhsayCBS host. Check the web root and any writable directories under the AhsayCBS install for recently created `.jsp`, `.jspx`, `.war` or `.class` files that are not part of the vendor distribution. - Hunt for XMRig. Look for a process named or masquerading as Microsoft Edge (`msedge.exe` on Windows, or a binary with an Edge-like name on Linux) that is consuming sustained CPU and connecting to mining pool addresses. The reporting says the miner is disguised as Edge, so name alone is not sufficient; check the parent process and the binary path. ### P2 (within 72h) - Restrict network access to the AhsayCBS management and API interfaces. The exploited endpoints are `/rps/api/json/UpdateReceivers.do` and the API component's `checkSysPwd` path. If these do not need to be reachable from the internet, block them at the perimeter. - Review AhsayCBS logs for requests to `/rps/api/json/UpdateReceivers.do` and for authentication attempts against the API component with unusual `random` parameter values. The sources do not provide a log format, so review the raw access and application logs. - If a web shell or miner is found, treat the host as compromised: isolate it, preserve volatile data, and rebuild rather than clean. ### P3 (within 7 days) - Confirm the patched version across all AhsayCBS instances, including any backup or replication nodes that may run the Replication Receiver component. - Review third-party risk documentation for the AhsayCBS deployment under DORA Art. 28 and Art. 30, and confirm the supplier has notified you of the incomplete-patch history. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviours and named components but no machine-pivotable values. Behavioural indicators: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------ | ----------------------- | | Authentication bypass via manipulation of the random parameter in the checkSysPwd function | AhsayCBS API component logs, com/ahsay/obs/api/ApiStructsAction.java code path | high (NVD/CISA) | | OS command injection via the random parameter at /rps/api/json/UpdateReceivers.do | AhsayCBS Replication Receiver access logs | high (NVD/CISA) | | Web shell dropped on the AhsayCBS host | Web root and writable directories under the AhsayCBS install | medium (single-sourced) | | XMRig miner disguised as Microsoft Edge | Process list, CPU usage, outbound connections to mining pools | medium (single-sourced) | No indicators of compromise available in the source material for the copyable block. ## 6\. Detection The sources give usable artefacts: the vulnerable endpoint path, the parameter name, and the Java class path. These are artefacts of the exploited component, not of the reporting, so they are valid detection strings. ```yara rule AhsayCBS_Exploit_Endpoint_Strings { meta: author = "Adverse Trace" date = "2026-10-15" reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105134" description = "Detects strings associated with the AhsayCBS Replication Receiver command injection endpoint and the vulnerable API class path." strings: $endpoint = "/rps/api/json/UpdateReceivers.do" ascii wide $classpath = "com/ahsay/obs/api/ApiStructsAction.java" ascii wide $func = "checkSysPwd" ascii wide $param = "random" ascii wide condition: uint16(0) == 0x4D5A or $endpoint or $classpath or $func } ``` ```yaml title: AhsayCBS Exploit Endpoint Access id: 8f3c2a1e-4b7d-4e9a-9c1f-2d6e8a0b3c5f status: experimental description: Detects HTTP requests to the AhsayCBS Replication Receiver command injection endpoint, which is exploited in the wild via CVE-2026-105134. author: Adverse Trace date: 2026/10/15 references: - https://nvd.nist.gov/vuln/detail/CVE-2026-105134 logsource: category: webserver detection: selection: cs-uri-stem|contains: '/rps/api/json/UpdateReceivers.do' condition: selection falsepositives: - Legitimate Replication Receiver updates from authorised management hosts level: high ``` ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-105134](https://nvd.nist.gov/vuln/detail/CVE-2026-105134?ref=f4n6.co.uk) | 9.3 Critical | ⚠ KEV 2026-10-14 | 2% | A flaw has been found in Ahsay AhsayCBS up to 10.3.2\. This vulnerability affects unknown code of the file /rps/api/json/UpdateR… | | [CVE-2026-105133](https://nvd.nist.gov/vuln/detail/CVE-2026-105133?ref=f4n6.co.uk) | 5.5 Medium | ⚠ KEV 2026-10-14 | 0% | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2\. This affects the function checkSysPwd of the file com/ahsay/obs/ap… | ## 7\. Sources - The Hacker News, "AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches", https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html, 2026-10-15 - Huntress, "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer", https://www.huntress.com/blog/ahsaycbs-flaws-exploit - SecurityWeek, "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild", https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/ - NVD/CISA KEV, CVE-2026-105133, https://nvd.nist.gov/vuln/detail/CVE-2026-105133 - NVD/CISA KEV, CVE-2026-105134, https://nvd.nist.gov/vuln/detail/CVE-2026-105134 - The Hacker News, "Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge", https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-105134 as the priority: CVSS 9.3 CRITICAL, in CISA KEV, with a remediation due date of 2026-10-17, and confirmed in-the-wild command execution. CVE-2026-105133 is CVSS 5.5 MEDIUM but is the authentication bypass that makes the chain work, so it cannot be deprioritised. The malware-capability detail (web shells, XMRig disguised as Edge) is single-sourced from Huntress and The Hacker News; we treat it as credible but unconfirmed until a second vendor corroborates. No actor attribution is available in the source material, so none is made. We will monitor for additional vendor confirmation of the exploitation detail and for any expansion of the KEV entry, and we will update this advisory if the patch status changes. Clients running internet-exposed AhsayCBS should treat the 2026-10-17 KEV date as the deadline and patch to 10.3.4 or isolate the instance before then. --- [Read the original source →](https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*