CVE-2026-105133/105134: AhsayCBS chain exploited

Call: Patch now. Two AhsayCBS bugs are being chained in the wild: CVE-2026-105133 gets past authentication, and CVE-2026-105134 runs commands as SYSTEM. Huntress saw exploitation start October 7, CISA added both to KEV on October 14, and Ahsay has had hotfixes out since October 10. If your backup console still isn’t patched a month later, assume someone else has looked at it.

What breaks: The API’s checkSysPwd check accepts a random token in place of real credentials (CVE-2026-105133). That opens /rps/api/json/UpdateReceivers.do in the Replication Receiver, where a command injection (CVE-2026-105134) gives unauthenticated code execution as NT AUTHORITY\SYSTEM. Huntress says attackers added a malicious replication receiver and dropped JSP webshells into the CBS web app folder.

Huntress’s follow-up covers three servers breached between October 8 and 11. It found five webshell families, including one that hides encrypted payloads in PNG pixel data, XMRig miners restarted by a SYSTEM scheduled task, a Python implant that only runs on the host it was staged for, tunneling and remote access tools, broad Defender exclusions, and a command consistent with NetExec’s Veeam credential-theft module. That last one is the point: this crew went for backup infrastructure on purpose.

Who’s hit: Service providers and companies running their own AhsayCBS server, v10 through 10.3.4.0 and v7 through v9. Internet-facing consoles are the target.

Fix:

v10: install 10.3.4.0, then hotfix 10.3.4.45 (released October 10). Huntress says 10.3.4.45 blocks the entry point it saw.
v9: install 9.15.0.0, then hotfix 9.15.2.70 (released October 12).
v7 and v8: upgrade to 9.15.0.0 first, then apply 9.15.2.70.

Check whether you were hit: Ahsay says your server is compromised if you see any of these:

Odd folders at the root of a drive, such as ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user or opt.
Randomly named .jsp files (like 75bc584d292933ad.jsp) or short random folders in %CBS%\webapps.
RPS receivers or Admin-type AhsayCBS accounts you didn’t create.

Patching doesn’t remove a webshell that’s already there. If you find any of the above, follow Ahsay’s recovery steps (restore from an Auto Save from before the first suspicious timestamp), and rotate any credentials that server could reach, including your Veeam ones if Veeam lives nearby.

Sources: Ahsay status update (opens in a new tab), Huntress (first wave) (opens in a new tab), Huntress (webshells and implant) (opens in a new tab), The Hacker News (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-105133/105134: AhsayCBS chain exploited

Sources

More from November 2026 patch cycle