CVE-2026-105133

What is Ahsay AhsayCBS?

AhsayCBS is the server component of Ahsay's Cloud Backup Suite, a Java web application that provides the backup management console, holds customer backup sets, and replicates them to secondary receivers. It is sold largely to managed service providers and system integrators, so one console typically serves many downstream client organizations. The console is normally internet-facing so that remote backup agents can reach it, which places its authentication layer on the perimeter. Compromise of that layer gives an attacker the one system an organization expects to fall back on after an incident, plus, in an MSP deployment, a path toward every tenant behind it.

Overview

CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java, part of the AhsayCBS API component. A remote attacker can manipulate the random argument to satisfy the credential check without holding valid credentials. NVD rates it 7.3 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L); Huntress scores it 5.5 Medium under CVSS 4.0, and The Hacker News repeats that figure, so the two scoring systems disagree sharply on this one.

The modest score understates its role. On its own the bypass grants limited access, which is what the Low confidentiality, integrity, and availability metrics reflect. In practice it is the first link in a two-stage chain: attackers use it to get past authentication and then invoke CVE-2026-105134, the command injection in the Replication Receiver API, to execute code as NT AUTHORITY\SYSTEM. The pair converts a post-authentication RCE into an unauthenticated one, which is why CISA added both to the KEV catalog on the same day.

VulDB published the record on 2026-10-04 with exploit code already public. Huntress detected the first exploitation attempt on 2026-10-07 at 23:20:15 UTC and counted five targeted organizations by 2026-10-08. Ahsay's first remediation attempt failed, and the vendor acknowledged on 2026-10-12 that builds v9.15.2.59 and v10.3.4.0 "did not fully address" either CVE.

Affected Versions

The original CVE record described the affected range as up to 10.3.2 and named 10.3.4 as the upgrade target. That guidance was wrong: Huntress tested 10.3.4 and found it still exploitable, and the vendor subsequently confirmed it. Ahsay's own announcement does not publish exact ranges, referring only to "affected v10 versions" and "affected v7, v8, and v9 versions". Both hotfixes are available only through the Ahsay partner portal, which requires a partner login.

Technical Details

The CWE is CWE-287, improper authentication: the application accepts something as proof of identity that an attacker can produce. Here the check lives in checkSysPwd, which is supposed to validate a system password before API calls proceed. The random parameter the function consults is attacker-supplied, and supplying a crafted value satisfies the check in place of real credentials. Huntress describes the effect on the Replication Receiver API in the same terms, a random token substituting for valid credentials.

The attack needs network reach to the console and nothing else: no prior authentication, no user interaction, and low complexity. It is a single request rather than a race or a multi-step timing attack. The chain with CVE-2026-105134 is likewise straightforward to automate, which matches the indiscriminate scanning behaviour reported in the campaign. Note that the two CVE records draw the authentication boundary slightly differently than some secondary coverage does, with SecurityWeek describing the Replication Receiver API itself as accepting the random token; the net result, unauthenticated SYSTEM-level code execution, is consistent across all sources.

Discovery

VulDB assigned and published the CVE on 2026-10-04, and no individual researcher is publicly credited with the original discovery. Exploit code was already public at the time of the record's publication, which left defenders effectively no lead time. The active exploitation was found and documented by Huntress, whose write-up is bylined to Dray Agha, Olly Maxwell, Tyler Bohlmann, and Amelia Casley. Huntress also did the version testing that disproved the published fix guidance and later verified that hotfix 10.3.4.45 blocks the entry point.

Exploitation Context

The activity observed to date is financially motivated cryptojacking rather than espionage, and no named threat actor has been attributed. Because this CVE is the access half of the chain, the post-exploitation evidence sits on the CVE-2026-105134 side: reconnaissance commands spawned as children of the AhsayCBS service process cbssvcX64.exe, JSP webshells dropped into the application directory, a malicious replication receiver configured for persistence, and an XMRig Monero miner named edge.exe installed as a service called MicrosoftEdgeUpdateSvc running as SYSTEM. One incident included the vulnerable WinRing0x64.sys kernel driver. Payloads came from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, and mining traffic went to xmr.kryptex[.]network:8029 and 51.195.127[.]124:8029.

Five organizations, as of 2026-10-08, is the only victim count published, and it reflects a single vendor's visibility. No Shadowserver, Censys, or Shodan tally of internet-exposed AhsayCBS consoles has been published, so the exposed population size is unknown. Given that the primary user base is MSPs, the count of directly affected servers understates the number of downstream organizations at risk.

Remediation

1. Apply hotfix 10.3.4.45 on the v10 line, or 9.15.2.70 for v7, v8, and v9, then reboot the server. Both come from the Ahsay partner portal; end customers without partner access should request the build through their MSP or Ahsay support.
2. Do not treat 10.3.4.0 or 9.15.2.59 as fixed. The vendor has confirmed those builds leave both CVEs exploitable, so a patch applied before 2026-10-12 does not count as remediation.
3. Restrict the management console to trusted source IP addresses or require VPN access. No code-level workaround exists, so limiting reachability is the only interim control.
4. Review authentication and API logs for requests carrying unusual random parameter values, and for API calls that succeeded without a preceding successful login.
5. Hunt for the follow-on activity: unexpected child processes of cbssvcX64.exe, new JSP files in the application directory, curl or certutil downloads into the Temp folder, the MicrosoftEdgeUpdateSvc service, and outbound traffic to the mining pool addresses. Huntress published four Sigma rules for this campaign.
6. Audit the replication receiver list for entries nobody on your team created.
7. If compromise is indicated, re-image the server from a known-good backup instead of removing individual artifacts, since secondary backdoors were observed. Rotate backup encryption keys, agent and tenant credentials, and any service accounts the console stored.
8. Federal civilian agencies must remediate by 2026-10-17 under BOD 26-04 and complete the forensic triage the directive requires.