---
title: "AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server"
url: https://erroneo.us/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/
description: "An auth bypass plus command injection gives SYSTEM on AhsayCBS, exploited since Oct 7. The first patches were incomplete: install 10.3.4.45 or 9.15.2.70."
type: security-brief
section: "Security Digest"
date_published: 2026-10-04
date_modified: 2026-10-15
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-105133", "CVE-2026-105134"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server

**Verdict: Act now.** If you or your MSP run an AhsayCBS backup server, install the October 12 hotfix today and hunt for webshells: the chain is unauthenticated, runs as SYSTEM, is being exploited by several actors, and the August patch did not fix it.

- **Who must act:** MSPs, system integrators and companies running AhsayCBS v7 through v10 below 10.3.4.45 or 9.15.2.70, including servers that already applied 10.3.4.0 or 9.15.2.59.
- **Who can relax:** Organizations that do not operate an AhsayCBS server; backup customers of a provider that uses Ahsay should still get written confirmation that the provider has patched and checked for compromise.
- **Affected:** AhsayCBS v10 before hotfix 10.3.4.45 (10.3.4.0 is not a complete fix); AhsayCBS v7, v8 and v9 before hotfix 9.15.2.70 (9.15.2.59 is not a complete fix)
- **Fixed:** AhsayCBS 10.3.4.45 hotfix (v10); AhsayCBS 9.15.2.70 hotfix (v7-v9)
- **CVEs:** CVE-2026-105133, CVE-2026-105134
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the build in the AhsayCBS web console under System Settings > License > Update License (Product Version).
2. Apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9) from Ahsay's partner portal, then reboot the server.
3. Restrict the management web interface to trusted admin IPs or a VPN.
4. Hunt for compromise back to Oct 4, 2026: new JSP files, shells spawned by the AhsayCBS service, a fake MicrosoftEdgeUpdateSvc, and new OpenSSH installs.
5. If you find indicators, re-image the host from a trusted backup and rotate every credential stored on or used by the server.

### How to check if you are affected

- Look for new or modified .jsp files in the AhsayCBS web application directories and .cmd or PowerShell files in C:\Users\Public.
- Alert on cmd.exe or powershell.exe launched by the AhsayCBS service, and on a MicrosoftEdgeUpdateSvc service running edge.exe or msedge.exe that is not Microsoft's.
- Check outbound traffic for 38.60.252.110 (reported by both Huntress and Bitdefender), xmr.kryptex.network:8029 and imagefiles-backup.oss-ap-southeast-7.aliyuncs.com.
- Review new services, scheduled tasks, accounts and privilege changes since Oct 4, 2026, and any OpenSSH server that appeared unexpectedly.

## What happened

AhsayCBS is the server and management console of Ahsay's backup platform. [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) says it is used mainly by MSPs and system integrators to create users, set backup policies and run backup operations. On October 4, 2026, VulDB published two CVEs against it and noted that an exploit had been published:

- **CVE-2026-105133** ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-105133), CWE-287): manipulating the `random` argument in the API's `checkSysPwd` function bypasses authentication. CVSS 3.1 7.3.
- **CVE-2026-105134** ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-105134), CWE-78): the same argument is injected into OS commands at the Replication Receiver endpoint `/rps/api/json/UpdateReceivers.do`. CVSS 3.1 10.0.

Three days later the chain was in use. Huntress saw the first exploitation on October 7 at 23:20 UTC and had counted five targeted organizations by October 8. The attackers ran code as SYSTEM, set up a malicious replication receiver and dropped JSP webshells. They also installed an XMRig miner disguised as `edge.exe`, kept alive by a fake `MicrosoftEdgeUpdateSvc` service. [Bitdefender](https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134)'s MDR team investigated three incidents involving webshells, PowerShell staged in `C:\Users\Public`, credential reconnaissance and an OpenSSH install via obfuscated PowerShell. It says "several different actors may be using the same exploits" and saw no encryption or exfiltration. CISA added both CVEs to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134) on October 14, with an October 17 deadline.

## Who is affected

The CVE records and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-105134) say AhsayCBS up to 10.3.2 is affected and 10.3.4 is not. That is no longer accurate. Huntress found on October 8 that 10.3.4 is also vulnerable. On October 12, [Ahsay](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update) said its earlier patches, 10.3.4.0 and 9.15.2.59, did not fully address the flaws, and released partner-only hotfixes: **10.3.4.45** for v10 and **9.15.2.70** for v7, v8 and v9. Ahsay's [10.3.4 release notes](https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4) (August 5, 2026) list no security fixes at all. Treat every build below those two hotfixes as vulnerable.

## Do you really need to act?

Only if an AhsayCBS server is yours or holds your data, and in that case, yes, today. The chain needs no credentials and gives SYSTEM on the machine that controls backup users, policies and operations for every customer it serves. Exploitation began within days of disclosure, more than one actor appears to be involved ([CVE-2026-105133](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133) is also in KEV), and many operators who installed 10.3.4.0 in good faith believed they were patched. Teams that only run endpoint backup clients against a provider's server have nothing to install, but they should ask the provider directly. Everyone else can ignore this one.

## What to do now

1. Confirm the build in the web console under **System Settings > License > Update License** (Product Version), as Bitdefender describes.
2. Download and apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9) from Ahsay's partner portal, then reboot, as Ahsay instructs. Huntress verified that 10.3.4.45 "mitigates the initial entry point."
3. Limit the management interface to trusted IPs or a VPN. Huntress and Bitdefender both recommend this, but it is not vendor guidance and not a substitute for patching.
4. Hunt from October 4 onward (next section). Patching does not remove webshells or other persistence.
5. If you find indicators, re-image from a trusted backup, as Huntress advises, and rotate credentials the server stores or uses.

## How to tell if you were hit

Look for new or changed `.jsp` files in the AhsayCBS web application directories, and `cmd.exe` or `powershell.exe` running as children of the AhsayCBS service. Other signs are a `MicrosoftEdgeUpdateSvc` service backed by `edge.exe` (XMRig) or `msedge.exe` (a modified NSSM), a `Taskgmr.ps1` script, a downloaded `WinRing0x64.sys` driver, `.cmd` files in `C:\Users\Public`, and an OpenSSH server that was never there before. On the network, check for traffic to `38.60.252.110` (reported by both firms), `xmr.kryptex.network:8029` and `imagefiles-backup.oss-ap-southeast-7.aliyuncs.com`. Bitdefender cautions that the reliable signal is "how the server behaves after the exploit fires," because static indicators change between actors.

## Timeline

- Aug 5, 2026 — AhsayCBS 10.3.4 is released.
- Oct 4, 2026 — CVE-2026-105133 and CVE-2026-105134 are published, with a public exploit noted.
- Oct 7, 2026 — Huntress sees the first exploitation at 23:20 UTC.
- Oct 8, 2026 — Huntress publishes its findings, then confirms that 10.3.4 is also affected.
- Oct 12, 2026 — Ahsay says the earlier patches were incomplete and releases hotfixes 10.3.4.45 and 9.15.2.70.
- Oct 14, 2026 — CISA adds both CVEs to KEV.
- Oct 15, 2026 — Bitdefender publishes its advisory, based on three incidents.

## Sources

1. [Ahsay — (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update)
2. [CVE record — CVE-2026-105133](https://www.cve.org/CVERecord?id=CVE-2026-105133)
3. [CVE record — CVE-2026-105134](https://www.cve.org/CVERecord?id=CVE-2026-105134)
4. [NVD — CVE-2026-105134](https://nvd.nist.gov/vuln/detail/CVE-2026-105134)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-105133](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-105134](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134)
7. [Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer](https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
8. [Bitdefender — Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)](https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134)
9. [Ahsay — AhsayCBS v10.3.4 release notes](https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4)

---
Source page: https://erroneo.us/security/briefs/ahsaycbs-cve-2026-105133-105134-backup-server-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt