CVE-2026-105134

What is Ahsay AhsayCBS?

AhsayCBS is the server half of Ahsay's Cloud Backup Suite: a Java web application that runs the backup console, stores customer backup sets, and replicates them to secondary receivers. Its customer base is concentrated among managed service providers and system integrators, who run one console on behalf of many downstream clients. That makes a single server a high-value target twice over. It holds the backup copies an organization would use to recover from ransomware, and in an MSP deployment it reaches into every tenant behind it. The management interface is routinely published to the internet so that remote agents can check in, which puts the vulnerable code path directly on the perimeter.

Overview

CVE-2026-105134 is an OS command injection in the Replication Receiver component, reached through the /rps/api/json/UpdateReceivers.do endpoint. NVD scores it 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); Huntress assigns 9.3 Critical under CVSS 4.0. Exploitation yields command execution as NT AUTHORITY\SYSTEM, because the injected command inherits the privileges of the AhsayCBS service process cbssvcX64.exe.

The record was published on 2026-10-04 by VulDB, and exploit code was already public at that point. Huntress saw the first in-the-wild attempt three days later, on 2026-10-07 at 23:20:15 UTC, and counted five targeted organizations by the following day. Attackers pair this flaw with CVE-2026-105133, the improper authentication issue in the same product, to turn what the CVE record describes as a post-authentication defect into fully unauthenticated remote code execution.

The patch history is the unusual part of this entry. Ahsay's original fixes, v9.15.2.59 and v10.3.4.0, did not work. Huntress tested 10.3.4, the then-current release that NVD's record named as the remediation, and found it still exploitable. Ahsay confirmed on 2026-10-12 that the earlier builds "did not fully address" either CVE and issued hotfixes. Anyone who patched before that date is still exposed.

Affected Versions

Both hotfixes are distributed through the Ahsay partner portal and require a valid partner login, which is an obstacle for end customers who do not hold one. Ahsay's announcement does not enumerate exact version ranges, referring only to "affected v10 versions" and "affected v7, v8, and v9 versions"; the ranges above combine the vendor notice with the version data in the CVE record and the Huntress testing.

Technical Details

The CWE is CWE-77, improper neutralization of special elements used in a command. The application takes attacker-controlled input and passes it into a string that the operating system executes, without escaping or rejecting the characters that let a caller terminate one command and begin another. The injection point is the random argument of UpdateReceivers.do in the Replication Receiver API. The same parameter name appears in CVE-2026-105133, where it is the token the authentication check accepts in place of a valid credential.

Attack characteristics are about as bad as the scoring allows: network reachable, low complexity, no user interaction, and no authentication once chained with CVE-2026-105133. Sources differ on exactly how the authentication boundary divides between the two CVEs. SecurityWeek describes the Replication Receiver API itself as accepting a random token instead of credentials, while the CVE records split the bypass and the injection cleanly. The practical effect is not in dispute: a remote attacker with no credentials reaches SYSTEM on the backup server.

Discovery

The CVE was assigned and published by VulDB on 2026-10-04, and no individual researcher is publicly credited with finding the original flaw. Exploit code was public at disclosure, which is what shortened the window before attacks began. The in-the-wild exploitation was discovered and documented by Huntress, with the write-up bylined to Dray Agha, Olly Maxwell, Tyler Bohlmann, and Amelia Casley. Huntress also independently verified that the 10.3.4.45 hotfix closes the entry point, after demonstrating that 10.3.4 did not.

Exploitation Context

The observed campaign is cryptojacking, not espionage, and no named threat actor has been attributed. After exploiting the chain, the attackers ran reconnaissance commands as child processes of cbssvcX64.exe, dropped JSP webshells into the application directory, and in some cases configured a malicious replication receiver on the target to hold access.

The payload stage used curl and certutil to pull files into the Temp folder from an Alibaba Cloud OSS bucket, imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com. Those files were edge.exe, an XMRig Monero miner masquerading as Microsoft Edge; msedge.exe, a modified NSSM utility used to install the miner as a service; config.json, rewritten by PowerShell before service creation; Taskgmr.ps1, a script that stops the miner service whenever Task Manager is running and kills Task Manager at 18:00 local time or after an hour open overnight; and, in one incident, the vulnerable WinRing0x64.sys kernel driver for hardware-level access. Persistence ran as SYSTEM under a Windows service named MicrosoftEdgeUpdateSvc. Mining traffic went to xmr.kryptex[.]network:8029 and 51.195.127[.]124:8029 under the pool user krxYMRN97D/creativejs. Attacker source addresses included 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10, and 123.202.208[.]37.

Five targeted organizations is the only victim figure published, and it is a snapshot from 2026-10-08 taken from one vendor's telemetry. No internet-exposure count for AhsayCBS has been published by Shadowserver, Censys, or Shodan, so the size of the reachable population is genuinely unknown.

Remediation

1. Apply hotfix 10.3.4.45 on the v10 line, or 9.15.2.70 on v7, v8, and v9, then reboot the server. Obtain them from the Ahsay partner portal; if you are an end customer without partner access, request the build through your MSP or Ahsay support.
2. Treat 10.3.4.0 and 9.15.2.59 as vulnerable. If you patched to either before 2026-10-12 and stopped there, you are not remediated, regardless of what the original CVE record said.
3. Restrict the management console to trusted source addresses or place it behind a VPN. There is no vendor-supplied workaround for the flaw itself, so network exposure reduction is the only interim control.
4. Hunt for compromise before trusting the patch. Look for unexpected child processes of cbssvcX64.exe, JSP files written into the application directory, curl or certutil downloads into Temp, a service named MicrosoftEdgeUpdateSvc, the WinRing0 driver, and outbound connections to the mining pool addresses above. Huntress published four Sigma rules covering this activity.
5. Review the replication receiver configuration for entries you did not create.
6. If any indicator matches, re-image the host from a known-good backup rather than cleaning it. The attackers hid secondary backdoors, and a backup server rebuilt on top of a webshell is worse than useless.
7. Rotate credentials the server held, including backup set encryption keys, tenant and agent credentials, and any stored service accounts.
8. Federal civilian agencies must remediate by 2026-10-17 under BOD 26-04 and complete the forensic triage the directive requires.