CVE-2026-105133 Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability

1. Executive summary

AhsayCBS, the Ahsay Cloud Backup Suite server, carries an improper authentication flaw (CVE-2026-105133, CVSS 5.5 MEDIUM, CWE-287) in the checkSysPwd function of its API component, exploitable by manipulating the random parameter. It chains directly with CVE-2026-105134 (CVSS 9.3 CRITICAL, CWE-77 and CWE-78 command injection) in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do, which lets a remote attacker run operating system commands. Both are being exploited in the wild, and the second is listed in CISA KEV with a remediation due date of 2026-10-17. Neither is recorded as used in ransomware campaigns. EMEA financial services firms running internet-facing AhsayCBS instances should treat this as an active intrusion path: the pair yields unauthenticated remote code execution, and observed post-exploitation has included web shells and XMRig cryptocurrency miners.

2. Regulatory framing

No article is cited for the mere fact that a third party or a patch is involved. The trigger in each row is the confirmed in-the-wild exploitation and the backup-server role of the affected system.

3. Technical analysis & attack chain

The two flaws are designed to be used together. CVE-2026-105133 defeats authentication; CVE-2026-105134 turns that access into command execution. The chain below is the confirmed sequence from the sources.

1. The attacker reaches the AhsayCBS API component and targets the checkSysPwd function in com/ahsay/obs/api/ApiStructsAction.java. By manipulating the random parameter, the attacker bypasses authentication (CVE-2026-105133, CWE-287).
2. With authentication bypassed, the attacker reaches the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint and manipulates the random parameter there to inject operating system commands (CVE-2026-105134, CWE-77 and CWE-78).
3. The injected commands run on the host. Observed post-exploitation has deployed web shells for persistent remote access and XMRig cryptocurrency miners.

The command injection is the higher-severity half of the pair at CVSS 9.3 CRITICAL; the authentication bypass is CVSS 5.5 MEDIUM on its own but is the access step that makes the critical flaw reachable without credentials. The two CVEs share the same manipulated parameter name (random) across two different components, which is why they chain cleanly.

The affected product is AhsayCBS, the Ahsay Cloud Backup Suite server. Huntress states the fix is version 10.3.4 and that access should be restricted. The sources do not give the vulnerable version range, the listening port, or the exact web shell filenames or paths, so those specifics cannot be provided here.

Attribution and tooling detail rest on vendor reporting. The XMRig miner and web shell deployment are described by The Hacker News and Huntress; the in-the-wild exploitation is reported by SecurityWeek, The Hacker News, and Huntress. No threat actor is named in the sources, and no MITRE ATT&CK profile is available in the verified reference data, so attribution is unconfirmed. Treat the miner and web shell as the observed impact, not as a signature of a specific group.

4. Mitigation & containment

P1 within 24h

• Patch AhsayCBS to 10.3.4, the version named by Huntress as the fix. Both CVEs are addressed by moving to this version.
• If patching cannot be completed immediately, take internet-facing AhsayCBS instances off the public internet or restrict access to trusted management networks only. Huntress explicitly advises restricting access.
• Hunt for web shells and XMRig on any AhsayCBS host that has been internet-reachable. Check the web root and the Replication Receiver paths for unexpected script files, and check for unexpected XMRig processes and outbound mining-pool connections.
• Because CVE-2026-105134 is in CISA KEV with a due date of 2026-10-17, treat remediation as time-boxed to that date.

P2 within 72h

• Rotate credentials and API keys associated with AhsayCBS, on the assumption that the authentication bypass (CVE-2026-105133) may have exposed them.
• Review AhsayCBS logs for requests to /rps/api/json/UpdateReceivers.do and for anomalous values in the random parameter, which is the manipulated field in both flaws.
• Confirm no scheduled tasks, services, or startup entries were created by the injected commands.

P3 within 7 days

• Inventory all AhsayCBS deployments, including any outside the primary estate, and confirm each is on 10.3.4 or later.
• Where the product cannot be patched or isolated, follow the vendor's mitigation guidance or discontinue use, consistent with the CISA BOD 26-04 instruction in the reference data.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe observable behaviours rather than atomic artefacts.

Behavioural indicators

The endpoint and function names are corroborated by the CVE reference data. The web shell and miner behaviours are single-sourced to vendor reporting in the corpus; verify before enforcement.

6. Detection

The sources give usable artefacts: the endpoint path, the function name, and the manipulated parameter. A Sigma rule keyed on the endpoint is the strongest detection available. No file hashes or distinctive malware strings are present, so a YARA rule is not emitted.

title: AhsayCBS Replication Receiver Command Injection Attempt
id: 8f2c1a44-7b3e-4d9a-9c21-ahsaycbs001
status: experimental
description: Detects requests to the AhsayCBS Replication Receiver endpoint abused for command injection (CVE-2026-105134), chained with authentication bypass (CVE-2026-105133).
author: Adverse Trace
date: 2026-10-14
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-105134
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105133
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/rps/api/json/UpdateReceivers.do'
  condition: selection
falsepositives:

  - Legitimate Replication Receiver updates from trusted management hosts
level: high

Tune the false-positive line by allowlisting known management source addresses. The checkSysPwd bypass has no single request signature in the sources, so it is covered by the behavioural indicators in §5 rather than a rule here.

CVE assessment

2 referenced CVEs — 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-105133 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-105133, published 2026-10-13
• NVD, CVE-2026-105134 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-105134
• SecurityWeek, Unpatched AhsayCBS Vulnerabilities Exploited in the Wild, https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/
• The Hacker News, Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge, https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
• Huntress, Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer, https://www.huntress.com/blog/ahsaycbs-flaws-exploit

8. Adverse Trace position

Adverse Trace assesses CVE-2026-105134 as the priority: CVSS 9.3 CRITICAL, CWE-77 and CWE-78, listed in CISA KEV with a remediation due date of 2026-10-17, and confirmed exploited in the wild. CVE-2026-105133 is CVSS 5.5 MEDIUM and not in KEV, but it is the access step that makes the critical flaw reachable, so we treat the pair as one intrusion path rather than two separate tickets. The impact for EMEA financial services clients is concentrated on internet-facing AhsayCBS backup servers, where compromise yields unauthenticated remote code execution and observed deployment of web shells and XMRig miners; the backup role of the affected system also raises the incident-classification stakes under DORA Art. 19. Attribution is unconfirmed: no actor is named in the sources and no MITRE ATT&CK profile is available in the verified reference data. We will track vendor guidance and any further exploitation reporting, and we will update this advisory if atomic indicators or a confirmed actor emerge. Clients should confirm their AhsayCBS version and internet exposure to us so we can prioritise the patch to 10.3.4 ahead of the 2026-10-17 KEV date.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.