CVE-2026-105133 and CVE-2026-105134
AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities
CVE-2026-105133 and CVE-2026-105134 affect AhsayCBS (Cloud Backup Server), the centralized management server for Ahsay backup software. Attackers are chaining these vulnerabilities to bypass authentication and execute code on exposed servers. Their CVSS 3.x base scores are 7.3 (High) and 10.0 (Critical), respectively. Huntress has confirmed exploitation involving JSP webshells and cryptocurrency miners.
Technical Details
CVE-2026-105133: Authentication Bypass
An improper authentication vulnerability affects the checkSysPwd function in AhsayCBS’s JSON API handler. Horizon3.ai’s reverse engineering confirmed the exploitable condition: com.ahsay.obs.json.JSONApi.execute() skips the checkSysPwd() password check whenever the request body carries “FromServlet”:”Y”, making every JSON API action reachable without valid credentials. The vulnerability has a CVSS 3.x base score of 7.3 (High).
CVE-2026-105134: Replication Receiver Remote Code Execution
The published CVE description classifies CVE-2026-105134 as OS command injection affecting /rps/api/json/UpdateReceivers.do in the Replication Receiver component. Its CVSS 3.x base score is 10.0 (Critical).
Horizon3.ai’s reverse engineering identified a path traversal in the replicated-file upload service, PUT /rps/obs7/rpsfile/upload. The service builds its destination path from attacker-controlled UserHome and TopDir request headers through getReplicatedPath(), without applying the path denylist used elsewhere in the product.
When chained with the authentication bypass, this file-write capability allows an attacker to place an executable JavaServer Pages (JSP) file in a web-served Tomcat application directory. Requesting the uploaded JSP executes code with the privileges of the AhsayCBS service account. This exploitation path requires the target to be configured or licensed as a replication receiver.
Compromise of the AhsayCBS host puts centrally managed backup policies, storage, and users at risk.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform – Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability chain can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from the NodeZero platform to determine whether the vulnerability chain is exploitable.
- Patch immediately: Apply the appropriate Ahsay hotfix and reboot the server. Restrict management access while completing remediation.
- Re-run the test: Confirm the vulnerability chain is no longer exploitable after remediation.
Indicators of Compromise
Huntress reported the following campaign indicators. Evaluate file names alongside their location and associated activity; a name alone does not establish compromise.
| Indicator | Type | Description |
imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com | Domain | Payload hosting used in observed attacks. |
Taskgmr.ps1 | File | Script used to conceal mining activity. |
edge.exe in a Temp directory | File | XMRig miner disguised as Microsoft Edge. |
msedge.exe in a Temp directory | File | Modified NSSM utility used for persistence. |
xmr.kryptex[.]network on port 8029 | Domain | Mining pool connection observed in the campaign. |
Ahsay also advises investigating unexpected JSP files under %CBS%\webapps, unauthorized replication receivers, and unauthorized AhsayCBS administrator accounts.
Affected Versions & Patch
Affected
Ahsay’s current remediation guidance covers affected v7, v8, v9, and v10 deployments. The vendor confirms that earlier patches v9.15.2.59 and v10.3.4.0 did not fully address these vulnerabilities. Installing those builds alone is insufficient.
Fixed
Follow the remediation path for your deployment:
| Deployment | Required remediation |
| AhsayCBS v10 | Apply hotfix v10.3.4.45. |
| AhsayCBS v9 | Apply hotfix v9.15.2.70. |
| AhsayCBS v7 or v8 | Upgrade to v9.15.0.0, then apply hotfix v9.15.2.70. |
Reboot the server after applying the hotfix. Hotfix downloads require a valid Ahsay partner portal account.
Ahsay states that these hotfixes fully address both CVEs. Huntress independently verified that v10.3.4.45 blocks the authentication bypass used as the attack chain’s initial entry point. That verification establishes that the observed unauthenticated chain is interrupted.
Mitigations and Recovery
Limit management interface access to trusted IP addresses or require a VPN.
Investigate potentially compromised servers before treating remediation as complete. For compromised hosts, Ahsay recommends reinstalling the operating system, installing AhsayCBS with the applicable hotfix, and restoring a server configuration that predates the compromise. Patching does not remove existing webshells, unauthorized accounts, or other attacker persistence.
Timeline
- October 4, 2026: The CVE records were published.
- October 7, 2026: Huntress began observing exploitation.
- October 8, 2026: Huntress confirmed that AhsayCBS 10.3.4 remained vulnerable.
- October 10, 2026: Ahsay released hotfix v10.3.4.45.
- October 12, 2026: Ahsay released hotfix v9.15.2.70 and advised v7 and v8 customers to upgrade before applying it.
- October 13, 2026: Ahsay published compromise assessment and recovery guidance.
- October 13, 2026: Horizon3.ai released the NodeZero Rapid Response test for both CVEs.
