AhsayCBS CVE-2026-105133 & CVE-2026-105134: Auth Bypass to RCE Chain Response Guide

All AhsayCBS versions up to 10.3.2 are affected. Ahsay's initial release, 10.3.4.0, was found to not fully close the vulnerability chain, and the vendor issued a second hotfix, 10.3.4.45, which is the version operators need to confirm is actually installed. Treat an appliance reporting '10.3.4.0' as still exposed — version-string checks alone are not sufficient; confirm the hotfix build number specifically.

A backup console is a high-value target by design — it typically has broad read access to the data it backs up across an organization.

• •Inventory every AhsayCBS instance and confirm the exact build number, not just the headline version — 10.3.4.0 is insufficient, 10.3.4.45 is required
• •Check whether the AhsayCBS web console is reachable from the internet; exploitation to date has targeted internet-facing instances
• •Review for unexpected processes or files consistent with webshells or XMRig cryptomining activity, the observed post-exploitation pattern

With active exploitation already confirmed and the first fix incomplete, treat this as emergency patching rather than scheduled maintenance.

• •Apply hotfix 10.3.4.45 (or later) — confirm the build number after patching, do not assume the update succeeded from the installer exit code alone
• •Where immediate patching isn't possible, restrict network access to the AhsayCBS console to trusted administrative networks only
• •Scan affected hosts for webshells and cryptomining processes (XMRig and similar) consistent with Huntress's reported post-exploitation activity
• •Treat any host showing signs of compromise as a full incident under your IR plan — rotate credentials accessible from the backup console and review what data it had access to

Huntress first observed exploitation on October 7, 2026 at 23:20:15 UTC via the Replication Receiver endpoint, giving defenders a concrete timestamp to anchor a retrospective log review against.

• •Check web server access logs for POST requests to /rps/api/json/UpdateReceivers.do, the exploited endpoint, especially from unrecognized source IPs
• •Look for JSP webshells dropped into the CBS-served application directory — the post-exploitation pattern Huntress reported
• •Check for unexpected XMRig or other cryptomining processes/binaries, and for outbound connections to mining pools from the backup host
• •Review AhsayCBS admin accounts and API keys for ones you don't recognize, since the auth-bypass half of the chain can be used to create persistent access independent of the RCE

Backup consoles are typically granted broad read access across an organisation's systems so they can back them up — the same trust relationship that makes a compromised backup server a high-value pivot point rather than an isolated incident. Treat any confirmed compromise here as a potential precursor to a wider ransomware or data-theft event, not a contained cryptomining nuisance, and prioritise it accordingly even though the initial observed payload (XMRig) looks low-stakes.