TL;DR
- AhsayCBS is the web management console for Ahsay's backup software, the server a managed service provider runs to hold and administer its customers' backup data.
- Two flaws in that console were disclosed on 4 October 2026 as CVE-2026-105133, an improper authentication flaw in the checkSysPwd function, and CVE-2026-105134, a command injection flaw in the Replication Receiver endpoint that reaches NT AUTHORITY/SYSTEM.
- Attackers chained them, using the first to bypass authentication and the second to run code, and Huntress observed exploitation from 7 October 2026 against internet-exposed appliances, with a JSP webshell and an XMRig miner following.
- Ahsay's announcement of 12 October 2026 states that its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully address the two flaws, and directs partners to hotfixes 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 to 9.
- Huntress separately verified that the 10.3.4.45 hotfix closes the initial entry point of the chain, which the previous version 10 builds left open.
- CISA added both records to its catalogue of known exploited vulnerabilities on 14 October 2026 with a due date of 17 October, and the command injection record carries a forensic triage requirement.
- For an operator of a backup appliance, the sequence is to take the management interface off the open internet, apply the hotfix, and rebuild the host from a trusted backup where indicators of compromise are found.
What Ahsay disclosed and what the researchers found
NVD disclosed the two vulnerabilities on 4 October 2026. CVE-2026-105133 sits in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java and produces improper authentication, rated medium; CVE-2026-105134 sits in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint and reaches unauthenticated remote code execution as NT AUTHORITY/SYSTEM, rated critical (Huntress, published 8 October 2026).
Huntress began seeing exploitation at 23:20:15 UTC on 7 October and had five organisations targeted by 8 October, a figure that counts organisations among its own customer base. BleepingComputer's reporting of the same campaign describes AhsayCBS as a platform typically used by managed service providers and system integrators, which in our reading is the detail that decides how far an incident spreads: the appliance holds the recovery copy for other companies' systems.
Ahsay's own announcement page (ahsay.com, retrieved 2026-10-16), where the vendor states that its previous patches did not fully address the two vulnerabilities and names the hotfixes.
The two flaws and how they fit together
The campaign depends on the two flaws working together. The bypass in checkSysPwd accepts a random token in place of valid credentials, so a request reaches the Replication Receiver API as an authenticated caller; the command injection behind it then executes on the host with the privileges the service holds. CISA's catalogue records both as manipulation of a random parameter and notes that one can be chained with the other.
Mapping is instructive for anyone maintaining detection content. The bypass is recorded as CWE-287, improper authentication, and the command injection as CWE-77 and CWE-78, command injection and operating system command injection. A defender who tracks only the critical identifier will miss the medium-severity flaw that makes it reachable.
What the attackers did after the door opened
Once inside, the campaign followed a pattern that reads as mining infrastructure with a foothold kept in reserve. A malicious replication receiver was configured and a JSP webshell written into the directory the CBS application serves. Payloads named Taskgmr.ps1, msedge.exe, edge.exe and config.json were downloaded from an Alibaba Cloud object storage host, with the XMRig miner renamed to resemble a Microsoft Edge process and a service called MicrosoftEdgeUpdateSvc created to keep it running, built on a modified copy of the Non-Sucking Service Manager binary running from a Temp folder with SYSTEM privileges (Huntress).
Two details separate this from a routine miner. The PowerShell script that hides the mining activity stops the service while Task Manager is open and restarts it when Task Manager closes, and terminates Task Manager at 18:00 local time or once it has stayed open more than an hour overnight. The attackers also downloaded WinRing0x64.sys, a legitimate but vulnerable kernel driver, so the miner could reach the hardware directly. Huntress published indicators of compromise and four Sigma rules.
Netics editorial diagram: what a chained vulnerability is, and how the two AhsayCBS flaws divide the work between them.
Why the second patch round is the story
BleepingComputer and SecurityWeek reported that NVD's records described version 10.3.2 as the fix, and Huntress's write-up of 8 October found every version through 10.3.4 affected. Ahsay's announcement of 12 October goes further and states plainly that the previous patches v9.15.2.59 and v10.3.4.0 did not fully address the vulnerabilities, directing version 10 partners to the 10.3.4.45 hotfix and versions 7 to 9 to 9.15.2.70, then instructing them to reboot the server. Both hotfixes sit behind a partner portal login.
The confirmation arrived from outside the vendor. Huntress independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the attack chain and notes that the entry point remained susceptible on previous version 10 builds. For an operator, that sequence is the transferable lesson: a version number in a disclosure record is a claim about remediation, and the evidence that a fix works can come from a party with telemetry on the exploitation.
The KEV deadline and the triage flag
CISA added both records to the Known Exploited Vulnerabilities catalogue on 14 October 2026 with a due date of 17 October, which puts the remediation order on a three-day clock for federal agencies and a useful priority signal for everyone else. The catalogue entry for the command injection flaw carries forensic triage as a requirement and records ransomware campaign use as unknown; the entry for the improper authentication flaw does not require triage.
The required action is stated in operational terms: apply mitigations following vendor instructions, evaluate each asset's internet exposure, and discontinue use of the product where mitigations are unavailable. That last clause is the one worth reading twice for a backup server, because the fallback for an unpatched appliance is removal from service. The mechanics of a catalogue deadline are the ones we described when five legacy flaws entered the same list earlier in October.
Netics editorial diagram: the four steps Huntress observed, from the authentication bypass to persistence under a name that resembles a Windows update service.
What a backup appliance operator should do next
Three steps follow from the sources. Take the management interface off the open internet and limit access to trusted addresses or a private network path. Apply the hotfix that matches the version in use and reboot, as the vendor instructs. Where any published indicator is present, rebuild the host from a trusted backup, because Huntress warns that secondary backdoors can remain for extended persistence.
Monitoring the appliance counts as infrastructure work in its own right, and it is the layer that turns an exploited management plane into a detected one; Netics builds that layer into deployments through infrastructure monitoring with plain-language alerts. The harder judgement sits with the managed service provider that runs backups for other companies: the appliance that holds the recovery copy is the one asset whose compromise removes the option of restoring from it, which is why the sequence above starts with access control and ends with a rebuild.
Huntress's research page on the campaign (huntress.com, retrieved 2026-10-16), carrying the exploitation timeline, the post-exploitation behaviour and the mitigation guidance.
Originally published on the Netics blog.
Top comments (0)