{"id":"CVE-2026-105133","kind":"vulnerability","aliases":["CVE-2026-105133"],"related":[],"title":"ahsay cloud backup suite: A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2","description":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"AhsayCBS authentication bypass in the JSON API (checkSysPwd is skipped). It is chained with CVE-2026-105134 for unauthenticated RCE. It has been exploited since about Oct 7 to drop JSP webshells and XMRig miners. A public PoC exists. Hotfixes 10.3.4.45 (v10) and 9.15.2.70 (v7-v9) fix it. The earlier 10.3.4.0 and 9.15.2.59 builds do not.","severity":"critical","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-10-14T00:00:00+00:00","products":[{"name":"Ahsay AhsayCBS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Ahsay AhsayCBS","fixed":["10.3.4.45","9.15.2.70"],"affected":"v7-v9 < 9.15.2.70; v10 <= 10.3.4.0 (< 10.3.4.45)","ecosystem":"vendor"},{"name":"ahsay cloud backup suite","fixed":["10.3.4"],"affected":"< 10.3.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ahsay","ahsaycbs","backup-servers","exploited","poc-public","self-hosted","vendor","webshell"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed AhsayCBS build. Anything below 10.3.4.45 (v10) or 9.15.2.70 (v7/v8/v9) is exposed, including 10.3.4.0 and 9.15.2.59. Then look for signs of compromise (Ahsay's list): odd folders at the drive root (ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt); randomly named .jsp files or short random folders in %CBS%\\webapps; RPS receivers you did not add; unknown Admin-type AhsayCBS users. Huntress also saw an XMRig miner posing as edge.exe and a fake Edge update Windows service.","fix":"Apply hotfix 10.3.4.45 on v10, or 9.15.2.70 on v9 (v7/v8: upgrade to 9.15.0.0 first, then apply the hotfix), then reboot. Download needs an Ahsay partner login. If any compromise indicator is present, Ahsay advises a full rebuild: reinstall the OS, install 9.15.0.0 or 10.3.4.0 plus the hotfix, and restore an Auto Save config from before the compromise. Until then, restrict the management interface to trusted IPs or a VPN.","status":"open","published_at":"2026-10-04T07:16:33+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:49:59+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T19:49:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per CISA KEV guidance (BOD 26-04); exact fixed version unknown from sources. If no mitigation exists, discontinue use of the product.","summary":"Ahsay AhsayCBS has an improper authentication flaw in the API component's checkSysPwd function, where manipulating the random parameter lets a remote attacker bypass login. It is listed as exploited in the wild and can be chained with CVE-2026-105134.","category":"vendor","who_cares":["ahsaycbs","backup-servers","self-hosted"],"confidence":0.7,"analyst_note":"Find the vendor advisory and affected/fixed versions for AhsayCBS and CVE-2026-105134 (the CISA KEV entry linked in sources does not list them).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.00039,"input_tokens":2267,"output_tokens":326,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected/fixed versions for AhsayCBS and CVE-2026-105134 (the CISA KEV entry linked in sources does not list them).","search":"'-04':153C,179C,210C '-105133':17A,20A '-105134':59B,135C '-2026':16A,19A,58B,134C '10.3.2':14A '10.3.4.0':94B '10.3.4.45':83B '26':152C,178C,209C '7':70B '9.15.2.59':96B '9.15.2.70':86B 'accord':142C 'action':138C 'adher':206C 'ahsay':1A,10A,21A,23A,25A,29B,98C 'ahsaycb':11A,30B,43B,99C 'ahsaycbs':22A,24A 'allow':107C 'api':49B,122C 'appli':139C 'applic':176C 'asset':200C 'attack':110C 'authent':44B,103C,113C 'backup':3A,27A,32B 'backup-serv':31B 'base':157C 'bod':151C,177C,208C 'build':97B 'bypass':45B,112C 'chain':55B,131C 'checksyspwd':50B,125C 'cisa':136C,149C,166C 'cloud':2A,26A,182C 'complianc':147C 'compon':123C 'contain':100C 'could':106C 'cve':15A,18A,57B,133C 'detect':8A 'discontinu':185C 'drop':72B 'earlier':93B 'ensur':146C,205C 'evalu':198C 'exist':81B 'exploit':34B,66B 'exposur':203C 'fix':90B 'follow':175C 'forens':168C 'function':126C 'guidanc':164C,180C 'guidelin':212C 'host':40B 'hotfix':82B 'improp':102C 'instruct':145C 'internet':202C 'json':48B 'jsp':73B 'manipul':115C 'miner':77B 'mitig':140C,191C 'note':163C,174C 'oct':69B 'paramet':119C 'patch':211C 'poc':36B,80B 'poc-publ':35B 'priorit':154C 'product':189C 'public':37B,79B 'random':118C 'rce':62B 'remot':109C 'requir':137C,170C 'respons':196C 'risk':159C 'secur':155C 'see':160C,171C 'self':39B 'self-host':38B 'server':33B 'servic':183C 'sinc':67B 'skip':52B 'stakehold':194C 'suit':4A 'suite':28A 'triag':169C 'unauthent':61B 'unavail':193C 'updat':156C 'url':161C,172C 'use':186C 'v10':84B 'v7':88B 'v7-v9':87B 'v9':89B 'vendor':41B,144C 'via':114C 'vulner':6A,104C,128C 'webshel':42B,74B 'xmrig':76B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-04T07:16:33+00:00","kev":{"dateAdded":"2026-10-14","dueDate":"2026-10-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-105133","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105133","severity":null,"published_at":"2026-10-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105133:6","url":null,"severity":null,"published_at":"2026-10-23T20:15:20+00:00","modified_at":"2026-10-23T20:15:20+00:00","first_seen_at":"2026-10-23T20:15:20+00:00","fetched_at":"2026-10-23T20:15:20+00:00","note":"Ahsay's advisories (Oct 12/13) give hotfixes 10.3.4.45 and 9.15.2.70; earlier patches 10.3.4.0 and 9.15.2.59 were incomplete. Exploited since Oct 7 (Huntress), public PoC (Horizon3). Same chain as CVE-2026-105134 (OS command injection / upload RCE). Horizon3 describes the bypass as FromServlet=Y skipping checkSysPwd, which differs from the KEV wording about the 'random' parameter. The hotfix download needs a partner login. The v7/v8 fixed version is the v9 hotfix, per Ahsay."},{"source":"nvd","external_id":"CVE-2026-105133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133","severity":null,"published_at":"2026-10-04T07:16:33+00:00","modified_at":"2026-10-15T13:47:06+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":14,"url":"https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update","title":"Ahsay: AhsayCBS Vulnerability Status Update","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":15,"url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","title":"Ahsay: Critical Security Alert update CVE-2026-105133/105134","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16,"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/","title":"Horizon3: CVE-2026-105133 & CVE-2026-105134 AhsayCBS","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":17,"url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","title":"Huntress: Threat Actors Exploit Critical AhsayCBS Flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":18,"url":"https://kitploit.com/en/tools/github/horizon3ai/ahsaycbs-auth-bypass-rce","title":"AhsayCBS-Auth-Bypass-RCE PoC (Horizon3, via Kitploit)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":470,"url":"https://www.rescana.com/post/ahsaycbs-cve-2026-105133-105134-exploited-backup-console-rce","title":"Rescana: AhsayCBS CVE-2026-105133/105134 analysis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}