AhsayCBS auth bypass to RCE: CVE-2026-105133 and -105134

AhsayCBS is backup server software, often run by managed service providers for many downstream customers. That makes a reachable, unauthenticated path to code execution unusually valuable: one compromised console can sit above a lot of data. CVE-2026-105133 and CVE-2026-105134 are that path, chained from an authentication bypass into command execution as SYSTEM.

The timeline is tight and the patch story is messy. The CVEs were published on 4 October 2026 with a note that a public exploit already existed. Huntress recorded exploitation starting 7 October and counted five targeted organizations by 8 October; Ahsay says it began getting partner reports of unauthorized access on 9 October. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 14 October. The complication: the first patch builds did not fully close the holes.

Who is affected

AhsayCBS before the October hotfixes. Branch matters because the fixed builds differ.

AhsayCBS v7 and v8 have no direct hotfix: upgrade to v9.15.0.0 first, then apply the v9 hotfix. Exposure comes down to reachability of the management interface; the chain itself needs no valid credentials.

How the chain works

Two flaws, used in order, turn an exposed console into SYSTEM-level command execution.

CVE-2026-105133 — authentication bypass (CWE-287)

The bug is in the checkSysPwd function of the API component. By manipulating the random parameter, a remote attacker can bypass authentication. On its own it is the way in; it is what lets the second flaw be reached without credentials.

CVE-2026-105134 — OS command injection (CWE-77, CWE-78)

The Replication Receiver endpoint /rps/api/json/UpdateReceivers.do mishandles the random parameter in a way that allows OS commands to run on the host. VulDB scored it CVSS 3.1 10.0. Reached through the auth bypass, it executes as SYSTEM.

Chained, the two are an unauthenticated path from the network to code execution. The authentication bypass is the lever, which is why Ahsay's hotfix closing that entry point also blocks the injection behind it.

Is it being exploited?

Yes, with named responders and specific post-exploitation activity.

• First seen: Huntress observed exploitation beginning 7 October 2026 at 23:20 UTC, and counted five targeted organizations by 8 October.
• Vendor reports: Ahsay began receiving partner reports of unauthorized access on 9 October.
• CISA KEV: both CVEs added 14 October 2026, due 17 October.
• Ransomware: none reported; CISA lists use as unknown.

The hands-on-keyboard activity Huntress documented includes reconnaissance, JSP webshells dropped into the web application directory, a malicious replication receiver configured for persistence, and an XMRig cryptominer renamed edge.exe, run as a SYSTEM service named MicrosoftEdgeUpdateSvc through a modified NSSM binary (msedge.exe). A PowerShell script, Taskgmr.ps1, hid the miner by stopping its service when Task Manager opened, and a vulnerable driver, WinRing0x64.sys, was used for kernel-level access.

Check your exposure

Confirm the build is a confirmed-fixed hotfix, and look for the folders and files attackers left behind.

# Confirm you are on a fixed hotfix, not just a patched-looking earlier build.
Get-Content "C:\AhsayCBS\version.txt" -ErrorAction SilentlyContinue
 
# Stray root folders Ahsay flagged, often created the same day.
Get-ChildItem C:\ -Directory | Where-Object { $_.Name -match '^(ahsay_ts|srv|user|opt)$' }
 
# Randomly named JSP files in the CBS webapps directory.
Get-ChildItem "C:\AhsayCBS\webapps" -Recurse -Include *.jsp -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

Adjust the install path to your deployment. Also review the AhsayCBS admin console for replication receivers and admin accounts you did not create.

Fix it

Apply the hotfix for your branch — 10.3.4.45 or 9.15.2.70 — and reboot the server; both hotfixes require a partner portal login to download. For v7 and v8, upgrade to v9.15.0.0 first, then apply the v9 hotfix.

If you find any indicator of compromise, Ahsay's guidance is to treat the host as compromised and rebuild: install a clean AhsayCBS (v9.15.0.0 or v10.3.4.0), apply the matching hotfix, and restore an Auto Save configuration from at least a day before the suspicious activity. Attackers hid secondary backdoors, so a clean rebuild is safer than a cleanup in place. Restrict the management interface to trusted IPs or a VPN either way.

Detect attempts and compromise

Combine Ahsay's host indicators with Huntress's process-level signals:

• Stray root folders created the same day, with names such as ahsay_ts, srv, user or opt.
• Randomly named .jsp files in the CBS webapps folder.
• Unauthorized replication receivers or unexpected admin accounts in the console.
• Service process spawning tools — cbssvcX64.exe launching curl or certutil.
• A fake Edge miner — edge.exe running as the service MicrosoftEdgeUpdateSvc, started by a modified msedge.exe.

Huntress published four Sigma rules covering these behaviours. If any fired, the attacker ran as SYSTEM; rebuild and rotate any credentials the backup server could reach.

Beyond this patch

The lasting lesson here is the incomplete-fix trap: a version number that looks patched is not proof a fix holds. Confirm a backup console is on a confirmed-fixed build, not merely a newer one, and verify the control actually blocks the abuse rather than assuming the release notes did. Rokkhe's approach to confirming a fix reproduces the finding and re-tests it; how a retest verifies a fix walks through that.