EN PT-BR
← Voltar ao feed
critical

AhsayCBS exploited via CVE-2026-105133 and CVE-2026-105134: webshells, XMRig miners and a C2 implant on backup servers

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 11:00 · coletado há 1 hora

Huntress reports that threat actors chained two AhsayCBS flaws, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated OS command injection in the Replication Receiver API that runs as SYSTEM), against internet-exposed backup management servers, with exploitation first seen on October 7, 2026 (huntress.com). This follow-up covers an intrusion on servers exploited between October 8 and 11, before Ahsay released its hotfixes, and it is far more persistent than the smash-and-grab pattern of the first wave: five JSP webshell families, two XMRig miners, tunneling and remote-access tools, a Python implant that calls out to a C2 domain, and a credential-theft attempt against a Veeam server in the same environment. Exploitation needs only network reach to the management interface and no user interaction, and CVE-2026-105134 carries a CVSS 3.1 base score of 10.0 (kev.5sn.com), so the operational urgency is critical. The hotfix blocks the entry point but does not remove files already planted, so exposed hosts need a compromise hunt as well as patching.

Entenda a falha

A vulnerabilidade

Two chained flaws in AhsayCBS, the management console of Ahsay backup software. CVE-2026-105134 (CVSS 3.1 10.0) is an unauthenticated OS command injection in the Replication Receiver API (/rps/api/json/UpdateReceivers.do) and gives command execution as NT AUTHORITY\SYSTEM on Windows. CVE-2026-105133 is an authentication bypass in the JSON API (Horizon3 gives a CVSS 3.x score of 7.3) that removes the need for credentials. The attacker only needs network reach to the management interface, with no user interaction. Fixed in v10.3.4.45 and v9.15.2.70; v7 and v8 must first upgrade to 9.15.0.0. Ahsay confirmed that v9.15.2.59 and v10.3.4.0 did not fully fix either CVE.

Como funciona

A request reaches the AhsayCBS JSON API. According to Horizon3, a request body carrying FromServlet=Y makes the JSON handler skip its password check, so every JSON API action becomes reachable without credentials. The attacker then reaches the Replication Receiver endpoint UpdateReceivers.do, where input is passed to the operating system as a command and runs as the service account (SYSTEM on Windows). Chained together, this lets an attacker write an executable JSP into a web-served Tomcat directory; requesting that file then runs code.

Por que é vulnerável

CVE-2026-105133 is a missing or bypassable authentication check: the checkSysPwd logic trusts a client-supplied parameter and skips the password check. CVE-2026-105134 is unsanitized input reaching an OS command in the Replication Receiver endpoint, running with SYSTEM privileges. The articles do not explain why they went unnoticed. The hotfix blocks the entry point (Huntress verified this for 10.3.4.45) but does not remove files already planted.

Onde está

The checkSysPwd logic of the AhsayCBS JSON API (CVE-2026-105133) and the endpoint /rps/api/json/UpdateReceivers.do (CVE-2026-105134); no public commit exists, since Ahsay ships hotfixes through its partner portal.

Como foi descoberta

Huntress began seeing threat actors exploit both flaws in early October 2026 (first seen October 7), and its first post covered the initial wave. This follow-up analyzes an intrusion on servers exploited between October 8 and 11, before Ahsay released its hotfixes. Huntress tied it to the same campaign through webshells in AhsayCBS web directories, an exploit source address in access logs listed in the first post, and matching indicators. Horizon3 has also published technical analysis of the bypass and the chain.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

The chain is exploited in the wild, with webshells, miners and a C2 implant planted on compromised servers, so a working exploit exists. The articles do not point to a published exploit or repository, so it is treated as private. Because exploitation is active and the hotfix does not clean existing compromises, patching is urgent and exposed hosts need a compromise hunt.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:22.

Detalhes técnicos

  • CVE-2026-105133 affects the checkSysPwd logic of the AhsayCBS JSON API. According to Horizon3, a request body carrying FromServlet=Y makes the JSON handler skip its password check, which leaves every JSON API action reachable without credentials (horizon3.ai). Horizon3 gives it a CVSS 3.x base score of 7.3 (horizon3.ai).
  • CVE-2026-105134 is an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (kev.5sn.com). Chained with the bypass, it lets an attacker write an executable JSP into a web-served Tomcat directory, and requesting that file runs code with the privileges of the AhsayCBS service account (horizon3.ai). Exploitation yields command execution as NT AUTHORITY\SYSTEM on Windows (kev.5sn.com).
  • Five JSP webshell families sit in webapps\cbs and webapps\rps. They include a key-gated shell that returns Base64 output, a shell that writes arbitrary files, self-deleting status_ and st_ shells, a loader that hides an AES-encrypted payload in PNG pixels, and an HMAC-signed remote administration API with exec, cd, upload and download actions.
  • The kvm-agent.exe XMRig build uses SupportXMR pools over TLS on port 443. A SYSTEM scheduled task named kvm checks every minute whether the miner runs and restarts it, and its start time is backdated.
  • A main.py wrapper in an embedded Python distribution under the SYSTEM profile is launched from a Run key. It decodes a payload that exits unless a marker file named after the SHA-256 of the host's MachineGuid exists. The payload loads an x64 DLL that contacts the C2 at creepexplosiondarknight[.]com over HTTPS and includes DNS-over-HTTPS strings. The malware family is not identified.
  • The environment also held gost, chisel, AnyDesk, Atera, Splashtop, a local account named wdguest, a Mimikatz package and Microsoft Defender exclusions covering C:\ProgramData, C:\Windows and the AhsayCBS service process.
  • On a Veeam server, a command consistent with NetExec's Veeam module queried stored credentials from the VeeamBackup PostgreSQL database and decrypted them with DPAPI. The number of credentials retrieved is unknown.

Remediação

  • Apply AhsayCBS v10.3.4.45 for v10 or v9.15.2.70 for v9. Servers on v7 or v8 must first upgrade to v9.15.0.0 and then apply v9.15.2.70, and a reboot is required (ahsay.com). Hotfix downloads require a partner portal login (ahsay.com).
  • Earlier builds are insufficient: Ahsay confirmed that v9.15.2.59 and v10.3.4.0 did not fully address either CVE (kev.5sn.com).
  • Restrict access to the management interface while patching (huntress.com).
  • On any server exposed before the hotfix, hunt for unexpected JSP files in webapps\cbs and webapps\rps, requests to UpdateReceivers.do, ahsay_* and timestamp-named folders, unknown SYSTEM scheduled tasks, unexpected Defender exclusions, and an embedded Python install launched from a Run key.
  • If compromise is confirmed, re-image from a trusted backup and rotate every credential stored on or reachable from the server, including those saved in AhsayCBS and other backup software on the network.
  • The public research did not surface a public repository, pull request or commit for the fix, which Ahsay distributes as hotfixes through its partner portal.

Linha do tempo

  1. huntress.com ↗ · pub. 09/11/2026 11:00 · coletado 09/11 12:00 primeiro registro

    AhsayCBS exploited via CVE-2026-105133 and CVE-2026-105134: webshells, XMRig miners and a C2 implant on backup servers

    ler a análise desta fonte

    Huntress reports that threat actors chained two AhsayCBS flaws, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated OS command injection in the Replication Receiver API that runs as SYSTEM), against internet-exposed backup management servers, with exploitation first seen on October 7, 2026 (huntress.com). This follow-up covers an intrusion on servers exploited between October 8 and 11, before Ahsay released its hotfixes, and it is far more persistent than the smash-and-grab pattern of the first wave: five JSP webshell families, two XMRig miners, tunneling and remote-access tools, a Python implant that calls out to a C2 domain, and a credential-theft attempt against a Veeam server in the same environment. Exploitation needs only network reach to the management interface and no user interaction, and CVE-2026-105134 carries a CVSS 3.1 base score of 10.0 (kev.5sn.com), so the operational urgency is critical. The hotfix blocks the entry point but does not remove files already planted, so exposed hosts need a compromise hunt as well as patching.

    Technical Details

    • CVE-2026-105133 affects the checkSysPwd logic of the AhsayCBS JSON API. According to Horizon3, a request body carrying FromServlet=Y makes the JSON handler skip its password check, which leaves every JSON API action reachable without credentials (horizon3.ai). Horizon3 gives it a CVSS 3.x base score of 7.3 (horizon3.ai).
    • CVE-2026-105134 is an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (kev.5sn.com). Chained with the bypass, it lets an attacker write an executable JSP into a web-served Tomcat directory, and requesting that file runs code with the privileges of the AhsayCBS service account (horizon3.ai). Exploitation yields command execution as NT AUTHORITY\SYSTEM on Windows (kev.5sn.com).
    • Five JSP webshell families sit in webapps\cbs and webapps\rps. They include a key-gated shell that returns Base64 output, a shell that writes arbitrary files, self-deleting status_ and st_ shells, a loader that hides an AES-encrypted payload in PNG pixels, and an HMAC-signed remote administration API with exec, cd, upload and download actions.
    • The kvm-agent.exe XMRig build uses SupportXMR pools over TLS on port 443. A SYSTEM scheduled task named kvm checks every minute whether the miner runs and restarts it, and its start time is backdated.
    • A main.py wrapper in an embedded Python distribution under the SYSTEM profile is launched from a Run key. It decodes a payload that exits unless a marker file named after the SHA-256 of the host's MachineGuid exists. The payload loads an x64 DLL that contacts the C2 at creepexplosiondarknight[.]com over HTTPS and includes DNS-over-HTTPS strings. The malware family is not identified.
    • The environment also held gost, chisel, AnyDesk, Atera, Splashtop, a local account named wdguest, a Mimikatz package and Microsoft Defender exclusions covering C:\ProgramData, C:\Windows and the AhsayCBS service process.
    • On a Veeam server, a command consistent with NetExec's Veeam module queried stored credentials from the VeeamBackup PostgreSQL database and decrypted them with DPAPI. The number of credentials retrieved is unknown.

    Remediation

    • Apply AhsayCBS v10.3.4.45 for v10 or v9.15.2.70 for v9. Servers on v7 or v8 must first upgrade to v9.15.0.0 and then apply v9.15.2.70, and a reboot is required (ahsay.com). Hotfix downloads require a partner portal login (ahsay.com).
    • Earlier builds are insufficient: Ahsay confirmed that v9.15.2.59 and v10.3.4.0 did not fully address either CVE (kev.5sn.com).
    • Restrict access to the management interface while patching (huntress.com).
    • On any server exposed before the hotfix, hunt for unexpected JSP files in webapps\cbs and webapps\rps, requests to UpdateReceivers.do, ahsay_* and timestamp-named folders, unknown SYSTEM scheduled tasks, unexpected Defender exclusions, and an embedded Python install launched from a Run key.
    • If compromise is confirmed, re-image from a trusted backup and rotate every credential stored on or reachable from the server, including those saved in AhsayCBS and other backup software on the network.
    • The public research did not surface a public repository, pull request or commit for the fix, which Ahsay distributes as hotfixes through its partner portal.