AhsayCBS Patch Failed to Close Two Flaws Attackers Are Chaining

Attackers are chaining two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to run commands on backup servers without credentials, and Ahsay said Oct. 12 that its earlier patches did not fully fix either.

The vendor's alert says the patched builds v9.15.2.59 and v10.3.4.0 were incomplete. The fix is a hotfix, v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9, and both are partner-only: downloading them needs a login to the Ahsay Partners Portal. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on Oct. 14 with a due date of Oct. 17.

What the two flaws let an attacker do

CVE-2026-105133 is an improper authentication bug in the checkSysPwd function of the API component. CVE-2026-105134 is an OS command injection in the Replication Receiver, reached through the /rps/api/json/UpdateReceivers.do endpoint. Both are triggered by manipulating a parameter named random, and CISA's catalog entries say each can be chained with the other.

The Hacker News reports CVSS v4 scores of 5.5 for the authentication bypass and 9.3 for the injection. The score understates the first bug: alone it is a moderate login flaw, but it is the step that turns the second into unauthenticated remote code execution. The Ahsay alert gives no scores, no affected-version ranges and no reporter.

Timeline from first exploitation to the KEV deadline

• Oct. 4: CVE IDs published, according to The Hacker News.
• Oct. 7, 11:20 p.m. UTC: Huntress, a managed detection and response company, sees exploitation begin.
• Oct. 8: Huntress estimates five organizations affected.
• Oct. 9: BleepingComputer reports no patch is available and that Huntress found 10.3.4 vulnerable.
• Oct. 12: Ahsay publishes the hotfix alert.
• Oct. 14: CISA adds both CVEs to the KEV catalog.

What Huntress saw on compromised hosts

Per BleepingComputer, the intruders ran reconnaissance, then dropped Java Server Page web shells. They downloaded an XMRig cryptominer disguised as edge.exe and kept it alive with a service named MicrosoftEdgeUpdateSvc that runs msedge.exe, which Huntress identified as a modified copy of the Non-Sucking Service Manager.

A PowerShell script, Taskgmr.ps1, stops mining when Task Manager opens and restarts it when Task Manager closes. Huntress believes the script is AI-assisted. In at least one case the attackers also fetched the vulnerable WinRing0x64.sys driver with certutil.exe, likely to give the miner more hardware access. Huntress published indicators of compromise and four Sigma detection rules.

Ahsay line	Hotfix	Earlier patch that failed
Version 10	v10.3.4.45	v10.3.4.0
Versions 7, 8 and 9	v9.15.2.70	v9.15.2.59

Where the sources disagree

The accounts of the patch status do not match. NVD advisories say the flaws are fixed in 10.3.4, according to The Hacker News. BleepingComputer cites a vendor-reported fix in 10.3.2 and Huntress's finding that 10.3.4 is also affected. Ahsay's own alert, dated three days after BleepingComputer's report, resolves it: the earlier patches were incomplete. BleepingComputer said it had contacted Ahsay about fix plans and received no response by publication.

Neither the vendor nor CISA says who is behind the attacks. CISA lists known ransomware campaign use as unknown for both entries. The Terminal found no count of exposed AhsayCBS instances in the sources it read.

What to do on an AhsayCBS server

Huntress recommends restricting the management interface to trusted IP addresses only, and The Hacker News says the exploit targets the externally accessible web application service. Apply the matching hotfix and reboot, as Ahsay instructs. If compromise is confirmed, Huntress says to perform a full restore of the host from a safe backup, since the intruders may have left more backdoors.

The Oct. 17 KEV deadline is the same three-day window CISA gave on other entries this month; see the BOD 26-04 deadline and the BeyondTrust Remote Support entry CISA added on Oct. 16.