CVE-2026-105134

What it is. Per the CVE records, CVE-2026-105133 is an authentication bypass in the checkSysPwd function of the AhsayCBS API, reached by manipulating a parameter named random. CVE-2026-105134 is an OS command injection flaw in /rps/api/json/UpdateReceivers.do, part of the Replication Receiver, through the same parameter. The Replication Receiver lets one AhsayCBS server receive replicated backup data from another. CISA says each flaw can be chained with the other, and Huntress says the chain gives an attacker code execution as NT AUTHORITY\SYSTEM.

How it unfolded. VulDB disclosed both flaws on October 3 and published the CVEs on October 4. Huntress saw the first exploitation at 23:20 UTC on October 7 and published its findings on October 8, then corrected them the same day to say 10.3.4, the latest release at the time, was also affected. Ahsay released the hotfixes on October 12. CISA added both CVEs to KEV on October 14.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on servers your organization owns or runs for customers under contract.

1. Is the server below 9.15.2.70 or 10.3.4.45? This decides exposure. Per the CVE records, every build up to 9.15.2.69 and 10.3.4.44 is affected, and that includes servers that took Ahsay's first patches, 9.15.2.59 and 10.3.4.0. Ahsay says the hotfix needs a reboot, so confirm the server restarted after it was applied. If a provider runs your backup server, ask them for the build number and the date it was applied.
2. Can untrusted networks reach the AhsayCBS web console? Both flaws are reached over the server's web interface. From a host outside your trusted network, this shows whether the console answers.
   curl -skI https://<ahsaycbs-host>/
   A server that answers from the internet goes first.
3. Was the server unpatched and reachable after October 7? If so, look for the indicators below before trusting it. Huntress says a compromised host needs a full re-image from a trusted backup, because attackers left secondary backdoors.

Public code. VulDB's records say exploits for both flaws have been published. We did not run any exploit code.

Ahsay's October 12 hotfix, followed by a reboot, is the fix. Until it is applied, responders recommend one stopgap.

• Limit access to the web console. Huntress says to restrict AhsayCBS management interface web access to trusted IP addresses or put it behind a VPN. Field Effect says to limit access to management interfaces and Replication Receiver services to trusted administrative networks. This only helps if every path to the web interface is closed to untrusted networks. If backup clients or replication partners reach this server over the internet, confirm they still connect after the change.

These come from Huntress, which saw the attacks on Windows servers. Huntress also published four Sigma rules for this activity in its threat intelligence repository.

• Unexpected child processes of the AhsayCBS service, cbssvcX64.exe or cbssvcX86.exe, such as command shells, curl or certutil.
• New JSP files in the AhsayCBS web application folder.
• A Windows service named MicrosoftEdgeUpdateSvc running msedge.exe or edge.exe from outside Microsoft Edge's install folder.
• WinRing0x64.sys or Taskgmr.ps1 in a user's AppData\Local\Temp folder.
• Downloads from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, and connections to xmr.kryptex[.]network on port 8029 or to 51.195.127[.]124.
• Traffic from 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10 or 123.202.208[.]37.
• SHA256 hashes 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 (msedge.exe, a modified NSSM), 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d (edge.exe, the XMRig miner) and 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 (Taskgmr.ps1).

Is CVE-2026-105134 being exploited?

Yes. Huntress saw exploitation begin on October 7, 2026, and CISA added it and CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on October 14.

We patched in early October. Are we covered?

Only if the server is on 9.15.2.70 or 10.3.4.45 and was rebooted afterward. Ahsay says its earlier patches, 9.15.2.59 and 10.3.4.0, did not fully fix the flaws.

Does an attacker need a login?

No. CVE-2026-105133 bypasses authentication, and the attacker then uses CVE-2026-105134 to run commands.

Where do we get the fix?

Ahsay publishes the hotfixes on partner-only pages that need a partner portal login. If a managed service provider runs your backup server, ask them which build it runs and when it was rebooted.

What if the server was already compromised?

Huntress recommends a full re-image of the host from a trusted backup, because the attackers left secondary backdoors. Patching alone does not remove them.

Nov 9, 2026. First published. Exploited since October 7; fixed in hotfixes 9.15.2.70 and 10.3.4.45 since October 12; on CISA KEV since October 14.

• Ahsay announcement, patch for CVE-2026-105133 and CVE-2026-105134 (Update) (Oct 12, 2026)
• Huntress, AhsayCBS flaws exploited (Oct 8, 2026, updated Oct 8 and Oct 12)
• VulDB CNA record for CVE-2026-105134 and CVE-2026-105133
• NIST NVD: CVE-2026-105134 and CVE-2026-105133 (Analyzed, CNA scores only, checked Nov 9)
• Field Effect (Oct 9, 2026)
• BleepingComputer (Oct 9, 2026)
• CISA Known Exploited Vulnerabilities catalog (both added Oct 14, 2026; checked the November 6, 2026 catalog release)