CVE-2026-105133: Ahsay AhsayCBS Authentication Bypass Chained to Unauthenticated RCE

Overview

A critical authentication bypass has been disclosed and actively exploited in AhsayCBS, the backup management console widely used by managed service providers (MSPs) and systems integrators to administer client backup jobs. Tracked as CVE-2026-105133, the flaw lives in the checkSysPwd function of the API component's ApiStructsAction.java, where manipulation of a random parameter lets a remote, unauthenticated attacker bypass login entirely.

On its own, CVE-2026-105133 is an authentication-bypass bug. The reason it earns a critical rating here is that security firm Huntress observed it being chained in the wild with a second flaw, CVE-2026-105134 — an OS command injection in the Replication Receiver component's UpdateReceivers.do endpoint. Chained together, the two bugs give an attacker unauthenticated remote code execution as NT AUTHORITY\SYSTEM on the backup server.

Technical Details

How It Works

The checkSysPwd function in AhsayCBS's API is supposed to validate an administrative password before granting access. Because it mishandles the random argument passed during that check, an attacker can manipulate the value to satisfy the comparison without ever supplying a valid credential — bypassing authentication outright (CVE-2026-105133).

From there, the attacker pivots to the Replication Receiver's UpdateReceivers.do endpoint, where a separate flaw (CVE-2026-105134) allows arguments to be manipulated into OS command injection. Huntress has described the two bugs as a deliberate two-step chain: CVE-2026-105133 opens the door past the login screen, and CVE-2026-105134 turns that access into arbitrary command execution — with no credentials, no user interaction, and no prior foothold required.

Impact Assessment

Who Is At Risk

Any organization running a self-hosted AhsayCBS 10.x console — especially version 10.3.4.0, where Ahsay's first patch attempt failed to close the hole — is exposed, including:

• MSPs and systems integrators managing client backup infrastructure through AhsayCBS
• Organizations exposing the AhsayCBS management console directly to the internet
• Any environment that has not yet applied the October 12 hotfix

Observed Exploitation Timeline

1. October 4, 2026 — Both CVE-2026-105133 and CVE-2026-105134 are published in the NVD
2. October 7, 2026 — Huntress begins observing active exploitation of the chain in the wild
3. October 8, 2026 — Five separate organizations confirmed targeted
4. October 10, 2026 — Ahsay confirms its initial patch, version 10.3.4.0, did not fully resolve either vulnerability
5. October 12, 2026 — Ahsay ships hotfix 10.3.4.45, which Huntress independently verified closes the authentication-bypass entry point

Post-Exploitation Activity

Once inside, attackers have been observed:

• Spawning suspicious child processes from cbssvcX64.exe
• Configuring a malicious replication receiver for persistence
• Dropping a JSP webshell into the application directory served by AhsayCBS
• Fetching additional payloads to %TEMP%, including a disguised Microsoft Edge executable that is actually an XMRig cryptominer communicating over port 8029
• Achieving persistence via a fake MicrosoftEdgeUpdateSvc service

Mitigation

Immediate Actions

• Apply hotfix 10.3.4.45 immediately and reboot affected AhsayCBS servers — the earlier 10.3.4.0 release does not fully resolve the issue
• Restrict direct internet access to the AhsayCBS management console as an interim measure if patching cannot happen immediately
• Audit for compromise on any instance that was internet-facing and unpatched between October 4 and October 12, 2026

Detection Opportunities

• Look for unexpected child processes under cbssvcX64.exe
• Check for newly created or modified replication receiver configurations that weren't provisioned by your team
• Search %TEMP% for files such as Taskgmr.ps1, msedge.exe, edge.exe, config.json, or WinRing0x64.sys fetched via certutil
• Flag outbound connections on port 8029, consistent with XMRig mining-pool traffic
• Inspect services for a fraudulent MicrosoftEdgeUpdateSvc entry not matching the legitimate Edge updater

Defence-in-Depth

• Place backup management consoles behind a VPN or allow-listed network rather than exposing them publicly
• Monitor backup infrastructure with the same rigor as production systems — it is a high-value target precisely because it holds broad access to client environments
• Maintain offline or immutable backup copies so a compromised backup console cannot be used to tamper with recovery data

Discovery & Disclosure

Both CVE-2026-105133 and CVE-2026-105134 were published in the NVD on October 4, 2026, by the VulDB CNA, with public exploit code noted as available. Active exploitation was first detected by Huntress on October 7, 2026. Ahsay's initial remediation in version 10.3.4.0 proved incomplete; the company's hotfix 10.3.4.45, released October 12, 2026, has been independently confirmed by Huntress to close the authentication-bypass entry point. Neither CVE had been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing, despite confirmed in-the-wild exploitation.

References

• NVD — CVE-2026-105133
• Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• The Hacker News — Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
• eSecurity Planet — Ahsay Confirms Failed Patch for Two Exploited Backup Flaws