Full Report
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier
Analysis Summary
# Vulnerability: AhsayCBS Authentication Bypass and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-105133 and CVE-2026-105134
- **CVSS Score:** Not explicitly listed in text (High/Critical implied by CISA KEV inclusion)
- **CWE:** Not specified (Authentication Bypass and Command Injection/RCE)
## Affected Systems
- **Products:** AhsayCBS Backup Software
- **Versions:**
- Version 9.x (prior to v9.15.2.70)
- Version 10.x (prior to v10.3.4.45)
- **Configurations:** Systems exposed to the internet are at highest risk.
## Vulnerability Description
This vulnerability involves two distinct flaws that can be chained together. The first flaw (CVE-2026-105133) allows an attacker to sidestep authentication mechanisms. Once unauthenticated access is achieved, the second flaw (CVE-2026-105134) allows for the execution of arbitrary commands. Previous patches released in August 2026 (v9.15.2.59 and v10.3.4.0) were found to be incomplete, leaving the entry point of the attack chain susceptible until the release of the October 2026 hotfixes.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by CISA KEV catalog).
- **Complexity:** Low (Chained for unauthenticated RCE).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Full system access and data theft potential).
- **Integrity:** High (Ability to drop web shells and modify system files).
- **Availability:** High (Observed deployment of XMRig cryptocurrency miners consuming system resources).
## Remediation
### Patches
Immediate upgrade to the following hotfix versions is required:
- **AhsayCBS v10.3.4.45** or later
- **AhsayCBS v9.15.2.70** or later
*Note: A system reboot is required after applying these hotfixes to ensure full mitigation.*
### Workarounds
No specific software workarounds provided; however, restricting network access to the AhsayCBS management interface to trusted IPs is a standard best practice.
## Detection
- **Indicators of Compromise:** Presence of unauthorized web shells or the `XMRig` cryptocurrency miner process/binary on the server.
- **Detection methods and tools:**
- Audit server logs for unusual unauthenticated requests.
- Monitor for unexpected outbound network traffic (common for cryptominers connecting to pools).
- Huntress has independently verified the entry point mitigation; security teams should verify their versioning against the hotfix releases.
## References
- **Vendor Advisory:** hxxps[://]www[.]ahsay[.]com/en/company/announcements/patch-cve-105133-105134-update
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Original Research:** hxxps[://]thehackernews[.]com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html