CVE-2026-105134 Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability

1. Executive summary

AhsayCBS, the Ahsay Cloud Backup Suite server, carries an OS command injection flaw, CVE-2026-105134, rated CVSS 9.3 CRITICAL, which a remote attacker can reach through the random parameter of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. It chains with CVE-2026-105133 (CVSS 5.5 MEDIUM), an improper authentication flaw in the checkSysPwd function that lets a remote attacker bypass authentication. Neither CVE is listed in CISA KEV in the reference data supplied to us, and EPSS sits at 2% for CVE-2026-105134 and 0% for CVE-2026-105133, but SecurityWeek and Huntress both report the pair is being exploited in the wild, with Huntress and The Hacker News describing webshell and XMRig cryptominer deployment. EMEA financial services clients running internet-exposed AhsayCBS should treat the exposure as active: the vendor fix is version 10.3.4, and until that is applied the only reliable control is removing the service from untrusted networks.

2. Regulatory framing

No other article in the regulatory reference is engaged by the facts here. The CISA remediation due date of 2026-10-17 in the source is a US federal directive (BOD 26-04) and does not itself create a DORA or NIS2 obligation, though it is a useful internal deadline.

3. Technical analysis & attack chain

The two CVEs are designed to be used together. CVE-2026-105133 removes the authentication barrier; CVE-2026-105134 turns that access into operating system command execution.

1. A remote attacker reaches the AhsayCBS API component and manipulates the random parameter in the checkSysPwd function to bypass authentication (CVE-2026-105133, CWE-287, CVSS 5.5 MEDIUM).
2. With authentication bypassed, the attacker sends a request to the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint, manipulating the random parameter there to inject operating system commands (CVE-2026-105134, CWE-77 and CWE-78, CVSS 9.3 CRITICAL).
3. The injected commands run on the AhsayCBS host. Huntress and The Hacker News report that in observed intrusions this leads to webshell deployment and XMRig cryptocurrency miner installation.

Vulnerability mechanism. Both flaws turn on the same parameter name, random, in two different components. CVE-2026-105133 is an improper authentication flaw in checkSysPwd; the source names the affected class as com/ahsay/obs/api/ApiStructsAction.java. CVE-2026-105134 is command injection in the Replication Receiver's UpdateReceivers.do handler. The verified reference data classifies the command injection as both CWE-77 (Command Injection) and CWE-78 (OS Command Injection); these describe the same flaw at different levels of specificity, and the source does not distinguish between them.

Payload and post-exploitation. Huntress reports webshells and XMRig cryptominers. The Hacker News adds that the XMRig miners are disguised as Microsoft Edge. The sources do not give file paths, process names, command lines, persistence mechanisms, C2 addresses, or lateral movement detail for these intrusions, so we cannot state them here. No ransomware use is reported; the source records "Known ransomware campaign use: Unknown" and the observed impact is webshell and cryptominer deployment, which is not the same as ransomware.

Confidence caveats. The exploitation-in-the-wild claim rests on SecurityWeek, Huntress and The Hacker News, which is multi-source, but the specific payload detail (webshell, XMRig, Edge disguise) is reported by Huntress and The Hacker News and we have not seen it corroborated elsewhere in the material supplied. No threat actor is named in any source, and the verified reference data contains no MITRE ATT&CK profile for any actor in connection with this item, so any attribution would be unconfirmed. The CISA KEV status is NOT listed for either CVE in the verified reference data, even though the source text carries a CISA remediation due date of 2026-10-17; treat the KEV listing as absent and the due date as a US federal directive deadline, not a KEV entry.

4. Mitigation & containment

P1 (within 24 hours)

• Identify every AhsayCBS instance in the estate and determine which are reachable from untrusted networks. The Replication Receiver endpoint /rps/api/json/UpdateReceivers.do and the API component's checkSysPwd path are the attack surface; if either is internet-facing, that instance is the priority.
• Where the vendor fix cannot be applied immediately, remove the service from untrusted networks. Block inbound access to the AhsayCBS management and replication interfaces at the perimeter and at internal segmentation boundaries. Huntress states the same: update to 10.3.4 and restrict access.
• Hunt for webshells and XMRig on any AhsayCBS host that has been internet-exposed. The sources do not give file paths or hashes, so this is a behavioural hunt: unexpected processes, unexpected files under the web application directories, and outbound mining-pool traffic. Treat any positive as a compromise, not a misconfiguration.
• If compromise is confirmed, isolate the host and preserve it for forensics before rebuilding. The source references CISA "Forensics Triage Requirements"; follow your own equivalent evidence-handling procedure.

P2 (within 72 hours)

• Apply the vendor fix: upgrade AhsayCBS to version 10.3.4, the version named by Huntress. Confirm the version after upgrade rather than assuming the installer succeeded.
• Rotate credentials for the AhsayCBS service accounts and any accounts that authenticate to it, on the assumption that CVE-2026-105133 may have allowed authentication bypass. Rotate backup repository credentials too, since the product is a backup server.
• Review AhsayCBS logs for requests to /rps/api/json/UpdateReceivers.do and for calls into checkSysPwd from unexpected source addresses. The sources do not provide log field names or event IDs, so this is a manual review against the endpoint paths above.

P3 (within 7 days)

• Add the AhsayCBS host class to the asset inventory with version tracking, so the next advisory in this product line does not require a fresh discovery exercise.
• Review the third-party risk file for AhsayCBS under DORA Art. 28 and Art. 30: confirm the contract covers the vendor's patch notification and support obligations for this product.
• If the instance is internet-facing by design, document the business justification and the compensating controls, or decommission the exposure.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The sources describe behaviours but give no hashes, domains, IP addresses, file paths, registry keys, or command lines.

Behavioural indicators

6. Detection

The sources give no file hashes, no command-line strings, no mutex names, and no registry keys. The only concrete artefacts are the endpoint path and the function name, which are properties of the product rather than of the attacker's payload. A YARA rule built on those would detect the product, not the intrusion, so we do not emit one.

A Sigma rule is possible for the network-side behaviour, since the endpoint path is a genuine artefact of the attack traffic.

title: AhsayCBS Replication Receiver Command Injection Attempt
id: 8f3c1a2e-4b7d-4e9a-9c1f-2d6e8a0b5c34
status: experimental
description: Detects HTTP requests to the AhsayCBS Replication Receiver UpdateReceivers endpoint, the vector for CVE-2026-105134 command injection.
author: Adverse Trace
date: 2026-10-14
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-105134
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/rps/api/json/UpdateReceivers.do'
  condition: selection
falsepositives:

  - Legitimate replication configuration changes by administrators
level: high

CVE assessment

2 referenced CVEs — 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-105134 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-105134, published 2026-10-13.
• NVD, CVE-2026-105133 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-105133.
• SecurityWeek, "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild", https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/.
• Huntress, "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer", https://www.huntress.com/blog/ahsaycbs-flaws-exploit.
• The Hacker News, "Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge", https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-105134 as CVSS 9.3 CRITICAL and CVE-2026-105133 as CVSS 5.5 MEDIUM, per the verified reference data, with neither listed in CISA KEV and EPSS at 2% and 0% respectively. The EPSS figures understate the operational picture: three independent sources report live exploitation, and the chain gives a remote attacker command execution on a backup server, which is a high-value target because it holds the data an organisation relies on to recover. The specific payload reporting (webshells, XMRig disguised as Edge) is single-sourced to Huntress and The Hacker News and should be verified before enforcement; no actor is named in any source and we make no attribution. Clients running internet-exposed AhsayCBS should treat the vendor fix to 10.3.4 as the priority action and network restriction as the interim control. Adverse Trace will monitor for a CISA KEV listing on either CVE, for vendor confirmation of the fixed version, and for any named-actor reporting, and will issue a follow-up if the exploitation picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.