AhsayCBS 10.3.4 Was Not the Fix, Huntress Found, Before CISA Listed It

An attacker who can reach the AhsayCBS management console can skip the login and run commands as SYSTEM on the backup server, using two chained flaws that Huntress watched in use from Oct. 7. CISA added both to its Known Exploited Vulnerabilities catalog on Oct. 14.

The pair is CVE-2026-105133, an authentication bypass, and CVE-2026-105134, a command injection in the Replication Receiver component. They sat in a batch of four with a Palo Alto Networks PAN-OS flaw and a Cisco Secure Email Gateway flaw, according to Help Net Security. Federal civilian agencies had until Oct. 17 to remediate.

Why AhsayCBS 10.3.4 was not safe

Huntress's write-up gives the chronology. NVD published both CVEs on Oct. 4. Huntress saw exploitation begin at 23:20:15 UTC on Oct. 7, three days later, and counted five targeted organizations by Oct. 8.

Early reporting said the flaws were fixed in a recent release. BleepingComputer's Oct. 9 story said AhsayCBS 10.3.2 carried the fix, and The Hacker News cited NVD for 10.3.4. Huntress then corrected both: "Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities." It lists versions through 10.3.4 as affected. The Hacker News described that as "essentially turning them to zero-days."

Ahsay released a hotfix for CVE-2026-105133 on Oct. 12. Huntress said it verified that the 10.3.4.45 hotfix mitigates the initial entry point. Users of v7, v8 and v9 should install 9.15.2.70.

Ahsay line	Hotfix to install
v10 (through 10.3.4)	10.3.4.45
v7, v8, v9	9.15.2.70

How the two flaws chain

CVE-2026-105133 sits in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java. CVE-2026-105134 sits in /rps/api/json/UpdateReceivers.do, where Huntress wrote that "a random token" can substitute for valid credentials.

The Hacker News gave CVSS 4.0 scores of 5.5 and 9.3. The score understates the first bug. A medium rating on an authentication bypass reads as a nuisance, but it is the step that makes the 9.3 command injection reachable with no credentials. BleepingComputer reported that a public exploit exists for the bypass.

1. CVE-2026-76519 Cisco9.8 score
2. CVE-2026-105134 Ahsay9.3 score
3. CVE-2026-0322 PAN-OS8.6 score
4. CVE-2026-105133 Ahsay5.5 score

Source: The Hacker News (CVSS 4.0 for Ahsay), Help Net Security (Cisco, Palo Alto), accessed 2026-10-25

Scores come from different vendors and scoring versions, so they are a rough guide only.

What the intruders did next

Huntress said attackers set up a malicious replication receiver and dropped JSP webshells into the directory the application serves. The cbssvcX64.exe process then ran curl and certutil to pull files into Temp, including Taskgmr.ps1, msedge.exe, edge.exe and config.json.

edge.exe is an XMRig cryptocurrency miner posing as Microsoft Edge, which connected to a Monero pool on port 8029. A service named MicrosoftEdgeUpdateSvc runs msedge.exe, a modified NSSM service wrapper, as SYSTEM and restarts the miner after crashes or reboots.

The script Taskgmr.ps1 stops the miner service when Task Manager opens, restarts it when Task Manager closes, and kills Task Manager at 18:00 local time or if it stays open over an hour overnight. In one incident the attackers also loaded the vulnerable WinRing0x64.sys driver. Huntress credits Dray Agha, Olly Maxwell, Tyler Bohlmann and Amelia Casley.

The other three entries in the Oct. 14 batch

Palo Alto's advisory for CVE-2026-0322 says an authenticated attacker with network access to the management interface can run code as root. It rates the flaw 8.6 on CVSS 4.0 with exploit maturity "ATTACKED" and says "very limited exploitation has been observed." No workaround exists. Fixes include PAN-OS 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12. Cloud NGFW and Prisma Access are not affected. Palo Alto credits Suraj Siddharudh as an internal reporter.

Cisco's flaw, CVE-2026-76519, is a path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway, rated 9.8, according to Help Net. A crafted attachment allows arbitrary file writes and root command execution when File Reputation is assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Cisco said its PSIRT learned of active exploitation in October 2026 and that no workaround exists. Attackers with root may hide evidence, so Cisco advises checking external firewall logs.

The Terminal has covered other CISA-listed appliance flaws, including Fortinet's FortiMail CVE-2026-104286 and the five older CVEs in SafePay ransomware's advisory.

What to do on each product

For Palo Alto, the advisory says Threat Prevention Threat IDs 510046 and 510047 offer limited coverage but require SSL Decryption. Other listed measures are routing management traffic through a data-plane interface and replacing the inbound management certificate. Restricting management access to trusted internal IP addresses reduces risk, and the advisory adds that a jump-box-restricted setup scores 8.5.

Huntress's indicators of compromise cover six IP addresses, five URLs on Alibaba Cloud Object Storage, a mining pool address and SHA256 hashes for msedge.exe, edge.exe and Taskgmr.ps1.

Patch AhsayCBS to 10.3.4.45 or 9.15.2.70 and restrict the management interface to trusted addresses or a VPN. Huntress advises a full re-image from a trusted backup if any of its indicators appear, because intruders may leave secondary backdoors. It published four Sigma detection rules.

Huntress's last update said it had seen one more incident and no evidence of broader exploitation, per The Hacker News. Ahsay did not respond to BleepingComputer's request about its plans as of Oct. 9.