CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
Attackers are chaining AhsayCBS authentication-bypass and critical RCE flaws to deploy webshells and cryptominers.
Horizon3.ai reports attackers are chaining AhsayCBS flaws CVE-2026-105133, an authentication bypass scored CVSS 7.3, and CVE-2026-105134, a replication-receiver remote code execution flaw scored CVSS 10.0. Huntress confirmed exploitation beginning 7 October 2026, including JSP webshells, a PowerShell script, and XMRig miners disguised as Edge binaries. Earlier builds v9.15.2.59 and v10.3.4.0 did not fully fix the issues. Ahsay directs v10 users to hotfix v10.3.4.45 and v9 users to v9.15.2.70; v7 and v8 must upgrade to v9.15.0.0 first, then reboot.
- CVE-2026-105133 scores CVSS 7.3 and bypasses AhsayCBS authentication.
- CVE-2026-105134 scores CVSS 10.0 and enables replication-receiver code execution.
- Huntress observed JSP webshells and XMRig miners from 7 October 2026.
- Hotfixes 10.3.4.45 and 9.15.2.70 replace incomplete earlier patches.
- Versions 7 and 8 must reach 9.15.0.0 before the v9 hotfix and a reboot.
Vulnerabilities mentionedAll →
- CVE-2026-1051349.33%Unauthenticated OS Command Injection in AhsayCBSpublished · AhsayCBS KEV PoC +1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | aliyuncs.com | cator Type Description imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com Domain Payload hosting used in observed attacks. Taskgmr. |
| domain | kryptex.network | ectory File Modified NSSM utility used for persistence. xmr.kryptex[.]network on port 8029 Domain Mining pool connection observed in th |
Full article743 words · extracted from horizon3.ai · click to collapse
AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
CVE-2026-105133 and CVE-2026-105134 affect AhsayCBS (Cloud Backup Server), the centralized management server for Ahsay backup software. Attackers are chaining these vulnerabilities to bypass authentication and execute code on exposed servers. Their CVSS 3.x base scores are 7.3 (High) and 10.0 (Critical), respectively. Huntress has confirmed exploitation involving JSP webshells and cryptocurrency miners.
Technical Details
CVE-2026-105133: Authentication Bypass
An improper authentication vulnerability affects the checkSysPwd function in AhsayCBS’s JSON API handler. Horizon3.ai’s reverse engineering confirmed the exploitable condition: com.ahsay.obs.json.JSONApi.execute() skips the checkSysPwd() password check whenever the request body carries “FromServlet”:”Y”, making every JSON API action reachable without valid credentials. The vulnerability has a CVSS 3.x base score of 7.3 (High).
CVE-2026-105134: Replication Receiver Remote Code Execution
The published CVE description classifies CVE-2026-105134 as OS command injection affecting /rps/api/json/UpdateReceivers.do in the Replication Receiver component. Its CVSS 3.x base score is 10.0 (Critical).
Horizon3.ai’s reverse engineering identified a path traversal in the replicated-file upload service, PUT /rps/obs7/rpsfile/upload. The service builds its destination path from attacker-controlled UserHome and TopDir request headers through getReplicatedPath(), without applying the path denylist used elsewhere in the product.
When chained with the authentication bypass, this file-write capability allows an attacker to place an executable JavaServer Pages (JSP) file in a web-served Tomcat application directory. Requesting the uploaded JSP executes code with the privileges of the AhsayCBS service account. This exploitation path requires the target to be configured or licensed as a replication receiver.
Compromise of the AhsayCBS host puts centrally managed backup policies, storage, and users at risk.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform – Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability chain can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from the NodeZero platform to determine whether the vulnerability chain is exploitable.
- Patch immediately: Apply the appropriate Ahsay hotfix and reboot the server. Restrict management access while completing remediation.
- Re-run the test: Confirm the vulnerability chain is no longer exploitable after remediation.
Indicators of Compromise
Huntress reported the following campaign indicators. Evaluate file names alongside their location and associated activity; a name alone does not establish compromise.
| Indicator | Type | Description |
imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com | Domain | Payload hosting used in observed attacks. |
Taskgmr.ps1 | File | Script used to conceal mining activity. |
edge.exe in a Temp directory | File | XMRig miner disguised as Microsoft Edge. |
msedge.exe in a Temp directory | File | Modified NSSM utility used for persistence. |
xmr.kryptex[.]network on port 8029 | Domain | Mining pool connection observed in the campaign. |
Ahsay also advises investigating unexpected JSP files under %CBS%\webapps, unauthorized replication receivers, and unauthorized AhsayCBS administrator accounts.
Affected Versions & Patch
Affected
Ahsay’s current remediation guidance covers affected v7, v8, v9, and v10 deployments. The vendor confirms that earlier patches v9.15.2.59 and v10.3.4.0 did not fully address these vulnerabilities. Installing those builds alone is insufficient.
Fixed
Follow the remediation path for your deployment:
| Deployment | Required remediation |
| AhsayCBS v10 | Apply hotfix v10.3.4.45. |
| AhsayCBS v9 | Apply hotfix v9.15.2.70. |
| AhsayCBS v7 or v8 | Upgrade to v9.15.0.0, then apply hotfix v9.15.2.70. |
Reboot the server after applying the hotfix. Hotfix downloads require a valid Ahsay partner portal account.
Ahsay states that these hotfixes fully address both CVEs. Huntress independently verified that v10.3.4.45 blocks the authentication bypass used as the attack chain’s initial entry point. That verification establishes that the observed unauthenticated chain is interrupted.
Mitigations and Recovery
Limit management interface access to trusted IP addresses or require a VPN.
Investigate potentially compromised servers before treating remediation as complete. For compromised hosts, Ahsay recommends reinstalling the operating system, installing AhsayCBS with the applicable hotfix, and restoring a server configuration that predates the compromise. Patching does not remove existing webshells, unauthorized accounts, or other attacker persistence.
Timeline
- October 4, 2026: The CVE records were published.
- October 7, 2026: Huntress began observing exploitation.
- October 8, 2026: Huntress confirmed that AhsayCBS 10.3.4 remained vulnerable.
- October 10, 2026: Ahsay released hotfix v10.3.4.45.
- October 12, 2026: Ahsay released hotfix v9.15.2.70 and advised v7 and v8 customers to upgrade before applying it.
- October 13, 2026: Ahsay published compromise assessment and recovery guidance.
- October 13, 2026: Horizon3.ai released the NodeZero Rapid Response test for both CVEs.