Ahsay Ships a Second Round of Fixes for Two Chained Flaws on Backup Servers

TL;DR

• AhsayCBS is the web management console for Ahsay's backup software, the server a managed service provider runs to hold and administer its customers' backup data.
• Two flaws in that console were disclosed on 4 October 2026 as CVE-2026-105133, an improper authentication flaw in the checkSysPwd function, and CVE-2026-105134, a command injection flaw in the Replication Receiver endpoint that reaches NT AUTHORITY/SYSTEM.
• Attackers chained them, using the first to bypass authentication and the second to run code, and Huntress observed exploitation from 7 October 2026 against internet-exposed appliances, with a JSP webshell and an XMRig miner following.
• Ahsay's announcement of 12 October 2026 states that its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully address the two flaws, and directs partners to hotfixes 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 to 9.
• Huntress separately verified that the 10.3.4.45 hotfix closes the initial entry point of the chain, which the previous version 10 builds left open.
• CISA added both records to its catalogue of known exploited vulnerabilities on 14 October 2026 with a due date of 17 October, and the command injection record carries a forensic triage requirement.
• For an operator of a backup appliance, the sequence is to take the management interface off the open internet, apply the hotfix, and rebuild the host from a trusted backup where indicators of compromise are found.

What Ahsay disclosed and what the researchers found

NVD disclosed the two vulnerabilities on 4 October 2026. CVE-2026-105133 sits in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java and produces improper authentication, rated medium; CVE-2026-105134 sits in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint and reaches unauthenticated remote code execution as NT AUTHORITY/SYSTEM, rated critical (Huntress, published 8 October 2026).

Huntress began seeing exploitation at 23:20:15 UTC on 7 October and had five organisations targeted by 8 October, a figure that counts organisations among its own customer base. BleepingComputer's reporting of the same campaign describes AhsayCBS as a platform typically used by managed service providers and system integrators, which in our reading is the detail that decides how far an incident spreads: the appliance holds the recovery copy for other companies' systems.

The two flaws and how they fit together

The campaign depends on the two flaws working together. The bypass in checkSysPwd accepts a random token in place of valid credentials, so a request reaches the Replication Receiver API as an authenticated caller; the command injection behind it then executes on the host with the privileges the service holds. CISA's catalogue records both as manipulation of a random parameter and notes that one can be chained with the other.

Mapping is instructive for anyone maintaining detection content. The bypass is recorded as CWE-287, improper authentication, and the command injection as CWE-77 and CWE-78, command injection and operating system command injection. A defender who tracks only the critical identifier will miss the medium-severity flaw that makes it reachable.

What the attackers did after the door opened

Once inside, the campaign followed a pattern that reads as mining infrastructure with a foothold kept in reserve. A malicious replication receiver was configured and a JSP webshell written into the directory the CBS application serves. Payloads named Taskgmr.ps1, msedge.exe, edge.exe and config.json were downloaded from an Alibaba Cloud object storage host, with the XMRig miner renamed to resemble a Microsoft Edge process and a service called MicrosoftEdgeUpdateSvc created to keep it running, built on a modified copy of the Non-Sucking Service Manager binary running from a Temp folder with SYSTEM privileges (Huntress).

Two details separate this from a routine miner. The PowerShell script that hides the mining activity stops the service while Task Manager is open and restarts it when Task Manager closes, and terminates Task Manager at 18:00 local time or once it has stayed open more than an hour overnight. The attackers also downloaded WinRing0x64.sys, a legitimate but vulnerable kernel driver, so the miner could reach the hardware directly. Huntress published indicators of compromise and four Sigma rules.

Why the second patch round is the story

BleepingComputer and SecurityWeek reported that NVD's records described version 10.3.2 as the fix, and Huntress's write-up of 8 October found every version through 10.3.4 affected. Ahsay's announcement of 12 October goes further and states plainly that the previous patches v9.15.2.59 and v10.3.4.0 did not fully address the vulnerabilities, directing version 10 partners to the 10.3.4.45 hotfix and versions 7 to 9 to 9.15.2.70, then instructing them to reboot the server. Both hotfixes sit behind a partner portal login.

The confirmation arrived from outside the vendor. Huntress independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the attack chain and notes that the entry point remained susceptible on previous version 10 builds. For an operator, that sequence is the transferable lesson: a version number in a disclosure record is a claim about remediation, and the evidence that a fix works can come from a party with telemetry on the exploitation.

The KEV deadline and the triage flag

CISA added both records to the Known Exploited Vulnerabilities catalogue on 14 October 2026 with a due date of 17 October, which puts the remediation order on a three-day clock for federal agencies and a useful priority signal for everyone else. The catalogue entry for the command injection flaw carries forensic triage as a requirement and records ransomware campaign use as unknown; the entry for the improper authentication flaw does not require triage.

The required action is stated in operational terms: apply mitigations following vendor instructions, evaluate each asset's internet exposure, and discontinue use of the product where mitigations are unavailable. That last clause is the one worth reading twice for a backup server, because the fallback for an unpatched appliance is removal from service. The mechanics of a catalogue deadline are the ones we described when five legacy flaws entered the same list earlier in October.

What a backup appliance operator should do next

Three steps follow from the sources. Take the management interface off the open internet and limit access to trusted addresses or a private network path. Apply the hotfix that matches the version in use and reboot, as the vendor instructs. Where any published indicator is present, rebuild the host from a trusted backup, because Huntress warns that secondary backdoors can remain for extended persistence.

Monitoring the appliance counts as infrastructure work in its own right, and it is the layer that turns an exploited management plane into a detected one; Netics builds that layer into deployments through infrastructure monitoring with plain-language alerts. The harder judgement sits with the managed service provider that runs backups for other companies: the appliance that holds the recovery copy is the one asset whose compromise removes the option of restoring from it, which is why the sequence above starts with access control and ends with a rebuild.

Sources

Source: (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134 — Ahsay company announcement, 12 October 2026, retrieved 2026-10-16 (the statement that the previous patches v9.15.2.59 and v10.3.4.0 did not fully address CVE-2026-105133 and CVE-2026-105134; the direction to apply the AhsayCBS v10.3.4.45 hotfix on affected version 10 installations and the v9.15.2.70 hotfix on affected versions 7, 8 and 9; both hotfixes requiring a partner portal login; the instruction to reboot the server after applying the hotfix).

Source: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer — Huntress, published 8 October 2026 and updated 12 October 2026, retrieved 2026-10-16 (the two vulnerabilities disclosed on 4 October 2026, CVE-2026-105133 in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java and CVE-2026-105134 in /rps/api/json/UpdateReceivers.do of the Replication Receiver component reaching unauthenticated remote code execution as NT AUTHORITY/SYSTEM; exploitation observed from 2026-10-07 23:20:15 UTC and five organisations targeted as of 8 October, counted among Huntress's own customers; a malicious replication receiver, JSP webshells, payload downloads from an Alibaba Cloud object storage host, an XMRig miner renamed edge.exe, the MicrosoftEdgeUpdateSvc service built on a modified Non-Sucking Service Manager binary running from Temp with SYSTEM privileges, Monero pool connections on port 8029, and the WinRing0x64.sys driver downloaded with certutil; Taskgmr.ps1 stopping the service while Task Manager is open and terminating Task Manager at 18:00 local time or after an hour overnight; all versions through 10.3.4 affected, with version 10.3.4 released on 5 August 2026; mitigation guidance to restrict management interface access to trusted addresses or a VPN and to re-image the host from a trusted backup where indicators are found; four Sigma rules and indicators of compromise published; the 12 October update stating that the hotfix addresses CVE-2026-105133 and prevents access to CVE-2026-105134, and that Huntress independently verified the 10.3.4.45 hotfix mitigates the initial entry point, which previous version 10 builds left susceptible).

Source: Known Exploited Vulnerabilities catalogue, version 2026.10.16, released 2026-10-16T17:15:48Z with 1,748 entries — CISA, retrieved 2026-10-16 (both Ahsay records added on 2026-10-14 with a due date of 2026-10-17; CVE-2026-105134 described as a command injection vulnerability allowing a remote attacker to execute operating system commands through manipulation of the random parameter in the Replication Receiver component's endpoint and as chainable with CVE-2026-105133, mapped to CWE-77 and CWE-78 with forensic triage required and ransomware campaign use recorded as unknown; CVE-2026-105133 described as an improper authentication vulnerability allowing a remote attacker to bypass authentication through manipulation of the random parameter in the checkSysPwd function, mapped to CWE-287 without a triage requirement; the required action being to apply mitigations in line with vendor instructions under BOD 26-04, evaluate each asset's internet exposure and discontinue use of the product where mitigations are unavailable).

Source: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto — BleepingComputer, 9 October 2026, and Unpatched AhsayCBS Vulnerabilities Exploited in the Wild — SecurityWeek, 9 October 2026, both retrieved 2026-10-16 (AhsayCBS described as a backup management platform typically used by managed service providers and system integrators; at least five organisations targeted with malicious activity observed on 7 October; both flaws reported as fixed in AhsayCBS 10.3.2 while Huntress found version 10.3.4 also affected; the recommendation to restrict management interface access and investigate for compromise until a patch is available).

Source: Ahsay's announcement of 12 October 2026, Huntress's research and its 12 October verification update, BleepingComputer and SecurityWeek coverage, and the CISA Known Exploited Vulnerabilities records of 14 October 2026 — the identifiers, versions, techniques, indicators and deadlines used above, retrieved 2026-10-16. Images are captures of the Ahsay and Huntress pages, plus two Netics editorial diagrams.