Ahsay's First AhsayCBS Patch Failed Against Two Exploited Flaws

Attackers are chaining two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to run code as SYSTEM on internet-exposed servers, and Ahsay's first fix, version 10.3.4.0, did not close them. CISA added both to its Known Exploited Vulnerabilities catalog on Oct. 14.

The attack needs no credentials, only network access to the AhsayCBS management interface. The fix that works today is a hotfix, 10.3.4.45 for version 10, and Ahsay distributes it through its authenticated partner portal, according to eSecurity Planet.

Which flaw does what

CVE-2026-105133 is an improper authentication bug in the checkSysPwd function. It is the one rated 5.5 under CVSS 4.0, a score published by VulDB, and Huntress calls it medium severity. Attackers use it first, to get past authentication.

CVE-2026-105134 is an OS command injection flaw in the Replication Receiver component, at /rps/api/json/UpdateReceivers.do, rated 9.3. Huntress says it allows unauthenticated remote code execution as NT AUTHORITY\SYSTEM. The score understates what the pair does together: a 5.5 on its own would rarely jump a patching queue, and it is the key that opens the 9.3.

The dates, and where the sources disagree

Date (2026)	Event	Source
Oct. 4	NVD publishes both CVEs	Huntress
Oct. 7, 23:20:15 UTC	Huntress sees first exploitation	Huntress
Oct. 8	Five targeted organizations counted	Huntress
Oct. 10	Ahsay confirms 10.3.4.0 was inadequate	eSecurity Planet
Oct. 12	Huntress reports hotfix release	Huntress
Oct. 14	CISA adds both CVEs to KEV	CISA

eSecurity Planet says NVD first listed 10.3.4 as unaffected and that later research contradicted it. Huntress's post, published Oct. 8 and updated Oct. 12, now says versions up through 10.3.4 are affected. eSecurity Planet dates Ahsay's admission to Oct. 10, while Huntress dates the hotfix to Oct. 12. The two are not necessarily in conflict, since an advisory can precede a build reaching partners, but neither source says so.

The five-organization count is the number Huntress saw targeted as of Oct. 8. It is not a count of confirmed breaches, and the post gives no later total. Nobody has published how many AhsayCBS servers are exposed to the internet.

What the attackers installed

After exploitation, the actor configured a malicious receiver and dropped a JSP webshell into the directly served application directory. In several incidents the AhsayCBS service process, cbssvcX64.exe, then used curl and certutil to pull files from an Alibaba Cloud object storage bucket into %TEMP%.

The payload was an XMRig cryptominer renamed edge.exe, pointed at a Monero pool on port 8029. A fake MicrosoftEdgeUpdateSvc service, built on a renamed NSSM binary named msedge.exe, restarts it. A PowerShell script, Taskgmr.ps1, stops the miner whenever Task Manager opens and restarts it when it closes. Huntress says the script's commented code looks AI-assisted. In one incident the actor also downloaded WinRing0x64.sys, a vulnerable driver that gives the miner low-level hardware access.

A miner is the visible part. Huntress warns that attackers have hidden secondary backdoors for extended persistence, and recommends a full re-image from a trusted backup if any indicator turns up.

What to do on a server today

Install 10.3.4.45 on version 10 and 9.15.2.70 on versions 7, 8 and 9, then reboot. Huntress says the hotfix "mitigates the initial entry point of this attack chain", which is narrower than saying every variant is closed. Restrict the management interface to trusted IP addresses or put it behind a VPN.

A patch that does not hold is a different problem from the one in the Atlassian case, where the fix existed and the gap was how fast attackers moved, and from the volume problem in October's Patch Tuesday. Here the fix on the shelf was the wrong one. CISA's Oct. 14 alert page lists no federal remediation due date for either CVE.