{"id":"ahsaycbs-auth-bypass-rce-attacks-oct-2026","category":"patch","status":"closed","title":"AhsayCBS backup server: login bypass and command flaws CVE-2026-105133, CVE-2026-105134 used in attacks","tldr":"Attackers are chaining two flaws in Ahsay's AhsayCBS backup server to run commands without a password. Ahsay's first patches were incomplete. IT providers should install hotfix v10.3.4.45 or v9.15.2.70, reboot, and check for web shells and miners.","summary":"Two flaws in AhsayCBS, a backup management server run mostly by IT providers and businesses, are being chained in attacks. CVE-2026-105133 lets an attacker skip the login, and CVE-2026-105134 then lets them run operating system commands on the server. Security firms Huntress and Bitdefender saw attacks from about 7 October 2026, including web shells (hidden remote-control scripts) and a disguised cryptocurrency miner. Ahsay said on 12 October that its earlier patches, v10.3.4.0 and v9.15.2.59, did not fully fix the flaws, and released hotfixes: v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9, followed by a reboot. The hotfixes are obtained through Ahsay's partner portal. CISA listed both flaws as exploited on 14 October. Bitdefender saw no data theft or ransomware but called ransomware a plausible next step. Ahsay lists no workaround. Patching does not remove a web shell already planted, so servers exposed before the fix should be checked. The Ahsay page does not itself say the flaws are being exploited.","action":"If you run AhsayCBS, or your IT provider does, install hotfix v10.3.4.45 (version 10) or v9.15.2.70 (versions 7 to 9) from Ahsay's partner portal, then reboot. Keep the admin console off the internet and have the server checked for web shells and miners since 4 October.","product":"Ahsay AhsayCBS backup management server (versions 7 to 10)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-105133","CVE-2026-105134"],"tags":["ahsay","ahsaycbs","backup","cisa-kev","authentication-bypass","command-injection","webshell","cryptominer"],"affected":["AhsayCBS v10 before v10.3.4.45 (including v10.3.4.0)","AhsayCBS v7, v8 and v9 before v9.15.2.70 (including v9.15.2.59)"],"fixed":["AhsayCBS v10.3.4.45 hotfix","AhsayCBS v9.15.2.70 hotfix"],"matches":[],"sources":[{"kind":"advisory","title":"Ahsay security alert: patch for CVE-2026-105133 and CVE-2026-105134 (update)","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","by":"Ahsay","date":"2026-10-12"},{"kind":"research","title":"Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)","url":"https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134","by":"Bitdefender","date":"2026-10-15"},{"kind":"news","title":"Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto","url":"https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/","by":"BleepingComputer","date":"2026-10-09"}],"started":"2026-10-04","closed":"2026-10-15","created":"2026-11-03T21:56:12.242Z","updated":"2026-11-03T21:56:12.242Z","cve_notes":[{"cve":"CVE-2026-105133","name":"Login bypass in AhsayCBS checkSysPwd API","what":"An improper authentication flaw in the checkSysPwd function of AhsayCBS's API that lets a remote attacker get past the login without a valid password, and which can be chained with CVE-2026-105134.","severity":"high","cvss":7.3},{"cve":"CVE-2026-105134","name":"Command injection in AhsayCBS Replication Receiver","what":"A command injection flaw in the Replication Receiver's UpdateReceivers endpoint in AhsayCBS that lets a remote attacker run operating system commands on the server, and which is chained with CVE-2026-105133.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-15","added":"2026-11-03T21:54:15.158Z","kind":"other","text":"Bitdefender reported three incidents it handled from about 7 October, with web shell, persistence and remote-access attempts that it blocked. It saw no encryption or data theft, and did not link the activity to one named group.","url":"https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134","by":"Bitdefender","patch":null},{"at":"2026-10-14","added":"2026-11-03T21:54:15.158Z","kind":"cisa-added","text":"CISA added both flaws to its list of vulnerabilities being used in attacks.","url":"https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134","by":"Bitdefender","patch":null},{"at":"2026-10-12","added":"2026-11-03T21:54:15.158Z","kind":"new-fix","text":"Ahsay said its earlier patches (v10.3.4.0 and v9.15.2.59) did not fully fix the flaws, and released hotfixes: v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9. Both need a server reboot.","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","by":"Ahsay","patch":"patched"},{"at":"2026-10-07","added":"2026-11-03T21:54:15.158Z","kind":"wider-attacks","text":"Security firm Huntress first saw the two flaws chained in attacks, and by 9 October had seen at least five organisations hit. Attackers dropped web shells and a hidden cryptocurrency miner. BleepingComputer reported that no patch was available for the affected versions at that point.","url":"https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/","by":"BleepingComputer","patch":"none"},{"at":"2026-10-04","added":"2026-11-03T21:54:15.158Z","kind":"disclosed","text":"Both flaws were published in the US National Vulnerability Database, which noted that a public exploit existed, according to Bitdefender.","url":"https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134","by":"Bitdefender","patch":"none"}],"url":"https://hard.fyi/live/ahsaycbs-auth-bypass-rce-attacks-oct-2026/","json":"https://hard.fyi/api/live?id=ahsaycbs-auth-bypass-rce-attacks-oct-2026"}