EN PT-BR
← Voltar ao feed
critical water

AhsayCBS CVE-2026-105133/CVE-2026-105134 chain exploited to plant webshells, XMRig miners and a Python C2 implant on backup servers

2 fonte(s) · 2 atualização(ões) · publicado 09/11/2026 11:00 · coletado há 10 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:02; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ huntress.com ↗

Threat actors chained two AhsayCBS flaws, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated OS command injection in the Replication Receiver API, running as SYSTEM), against internet-exposed backup management servers. Huntress first saw exploitation on October 7, 2026 (huntress.com). Its follow-up covers an intrusion on servers exploited between October 8 and 11, before Ahsay shipped its hotfixes, which came in mid-October 2026 (thehackernews.com). The activity is much more persistent than the first wave's smash-and-grab pattern: five JSP webshell families, two XMRig miners, tunneling and remote-access tools, a Python implant that calls a C2 domain, and a credential-theft attempt against a Veeam server in the same environment (huntress.com). Exploitation needs only network reach to the management interface and no user interaction. Huntress cites a CVSS 3.1 base score of 10.0 for CVE-2026-105134, so urgency is critical. The hotfix blocks the entry point but does not remove files already planted, so exposed hosts need a compromise hunt as well as patching.

Entenda a falha

A vulnerabilidade

CVE-2026-105134 is an unauthenticated OS command injection in the AhsayCBS Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. It gives command execution as NT AUTHORITY\SYSTEM on Windows, and Huntress cites a CVSS 3.1 score of 10.0. CVE-2026-105133 is an authentication bypass in the checkSysPwd logic of the JSON API; Horizon3 scores it 7.3. The attacker needs only network reach to the management interface, with no credentials or user interaction. Fixed in AhsayCBS 10.3.4.45 (v10) and 9.15.2.70 (v9). v7 and v8 must upgrade to 9.15.0.0 and then to 9.15.2.70.

Como funciona

A request reaches the AhsayCBS JSON API. According to Horizon3, a request body carrying FromServlet=Y makes the handler skip its password check, so every JSON API action can be called without credentials. The attacker then reaches the Replication Receiver endpoint UpdateReceivers.do, where input ends up being run as an operating-system command with SYSTEM privileges. Chained, the two let the attacker write an executable JSP into a web-served Tomcat directory and run it by requesting it. The articles do not detail the injection step itself.

Por que é vulnerável

For CVE-2026-105133, the JSON handler trusts a client-supplied value (FromServlet=Y) to decide whether to skip its password check, according to Horizon3's analysis cited by Huntress. For CVE-2026-105134, the articles describe an OS command injection but do not explain what input handling is missing. They do not say why either flaw went unnoticed or what the hotfix changes in the code. Huntress only verified that 10.3.4.45 blocks the entry point it saw. The hotfix does not remove files already planted.

Onde está

The articles name the checkSysPwd logic of the AhsayCBS JSON API (CVE-2026-105133) and the /rps/api/json/UpdateReceivers.do endpoint (CVE-2026-105134). No file or commit is given.

Como foi descoberta

Huntress saw exploitation in the wild starting October 7, 2026, and published a first post on a smash-and-grab wave of webshells and XMRig miners. Its follow-up, published November 9, covers servers exploited between October 8 and 11, before Ahsay's hotfixes in mid-October. Researcher Jonathan Semon described the intrusion, and the two flaws are assessed to have been used as zero-days. Horizon3 analyzed the authentication bypass. The articles do not say how or when the flaws were reported to Ahsay.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

The articles show a working exploit chain used in real attacks by an unidentified actor. It gave command execution and was used to drop five JSP webshell families, two XMRig miners, GOST and Chisel tunnels, remote access tools and a sandbox-evading Python implant. No article says exploit code was published, so it is treated as private. Because exploitation began before the hotfixes, exposed AhsayCBS hosts need urgent patching and a compromise hunt for the indicators Huntress listed.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:17.

Detalhes técnicos

  • CVE-2026-105133 affects the checkSysPwd logic of the AhsayCBS JSON API. Per Horizon3, a request body carrying FromServlet=Y makes the JSON handler skip its password check, leaving every JSON API action reachable without credentials. Horizon3 gives it a CVSS 3.x base score of 7.3 (huntress.com, citing Horizon3).
  • CVE-2026-105134 is an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. It yields command execution as NT AUTHORITY\SYSTEM on Windows. Chained with the bypass, an attacker can write an executable JSP into a web-served Tomcat directory and run code with the AhsayCBS service account's privileges by requesting it (huntress.com).
  • Five JSP webshell families sit in webapps\cbs and webapps\rps (huntress.com):
    • a key-gated shell that returns Base64 output;
    • a shell that writes arbitrary files;
    • self-deleting status_ and st_ shells;
    • a loader that hides an AES-encrypted payload in PNG pixels;
    • an HMAC-signed remote administration API with exec, cd, upload and download actions.
  • The kvm-agent.exe XMRig build mines to SupportXMR pools over TLS on port 443. A SYSTEM scheduled task named kvm checks every minute that the miner is running and restarts it, and its start time is backdated (huntress.com).
  • A main.py wrapper in an embedded Python distribution under the SYSTEM profile is launched from a Run key. It decodes a payload that exits unless a marker file named after the SHA-256 of the host's MachineGuid exists, which gives it sandbox-evasion behavior. The payload loads an x64 DLL that contacts the C2 at creepexplosiondarknight[.]com over HTTPS and contains DNS-over-HTTPS strings. The malware family is not identified (huntress.com, thehackernews.com).
  • The environment also held gost, chisel, AnyDesk, Atera, Splashtop, a local account named wdguest, a Mimikatz package and Microsoft Defender exclusions. The source text is truncated at this point, so further details are not available (huntress.com).

Remediação

  • Apply the Ahsay hotfixes for CVE-2026-105133 and CVE-2026-105134 and restrict network access to the AhsayCBS management interface (huntress.com, thehackernews.com).
  • Patching does not remove artifacts, so hunt for the following on any host that was exposed, especially between October 7 and the hotfix release (huntress.com):
    • JSP files in webapps\cbs and webapps\rps;
    • the kvm scheduled task and kvm-agent.exe;
    • the Python Run key persistence;
    • the wdguest account;
    • gost, chisel, AnyDesk, Atera and Splashtop;
    • unexpected Defender exclusions;
    • traffic to creepexplosiondarknight[.]com.
  • Review adjacent systems such as Veeam servers for credential theft, and rotate credentials that may have been exposed (huntress.com).

Linha do tempo

  1. thehackernews.com ↗ · pub. 10/11/2026 13:00 · coletado 10/11 15:00

    Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

    ler a análise desta fonte

    Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.

    The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.

  2. huntress.com ↗ · pub. 09/11/2026 11:00 · coletado 09/11 12:00 primeiro registro

    AhsayCBS exploited via CVE-2026-105133 and CVE-2026-105134: webshells, XMRig miners and a C2 implant on backup servers

    ler a análise desta fonte

    Huntress reports that threat actors chained two AhsayCBS flaws, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated OS command injection in the Replication Receiver API that runs as SYSTEM), against internet-exposed backup management servers, with exploitation first seen on October 7, 2026 (huntress.com). This follow-up covers an intrusion on servers exploited between October 8 and 11, before Ahsay released its hotfixes, and it is far more persistent than the smash-and-grab pattern of the first wave: five JSP webshell families, two XMRig miners, tunneling and remote-access tools, a Python implant that calls out to a C2 domain, and a credential-theft attempt against a Veeam server in the same environment. Exploitation needs only network reach to the management interface and no user interaction, and CVE-2026-105134 carries a CVSS 3.1 base score of 10.0 (kev.5sn.com), so the operational urgency is critical. The hotfix blocks the entry point but does not remove files already planted, so exposed hosts need a compromise hunt as well as patching.

    Technical Details

    • CVE-2026-105133 affects the checkSysPwd logic of the AhsayCBS JSON API. According to Horizon3, a request body carrying FromServlet=Y makes the JSON handler skip its password check, which leaves every JSON API action reachable without credentials (horizon3.ai). Horizon3 gives it a CVSS 3.x base score of 7.3 (horizon3.ai).
    • CVE-2026-105134 is an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (kev.5sn.com). Chained with the bypass, it lets an attacker write an executable JSP into a web-served Tomcat directory, and requesting that file runs code with the privileges of the AhsayCBS service account (horizon3.ai). Exploitation yields command execution as NT AUTHORITY\SYSTEM on Windows (kev.5sn.com).
    • Five JSP webshell families sit in webapps\cbs and webapps\rps. They include a key-gated shell that returns Base64 output, a shell that writes arbitrary files, self-deleting status_ and st_ shells, a loader that hides an AES-encrypted payload in PNG pixels, and an HMAC-signed remote administration API with exec, cd, upload and download actions.
    • The kvm-agent.exe XMRig build uses SupportXMR pools over TLS on port 443. A SYSTEM scheduled task named kvm checks every minute whether the miner runs and restarts it, and its start time is backdated.
    • A main.py wrapper in an embedded Python distribution under the SYSTEM profile is launched from a Run key. It decodes a payload that exits unless a marker file named after the SHA-256 of the host's MachineGuid exists. The payload loads an x64 DLL that contacts the C2 at creepexplosiondarknight[.]com over HTTPS and includes DNS-over-HTTPS strings. The malware family is not identified.
    • The environment also held gost, chisel, AnyDesk, Atera, Splashtop, a local account named wdguest, a Mimikatz package and Microsoft Defender exclusions covering C:\ProgramData, C:\Windows and the AhsayCBS service process.
    • On a Veeam server, a command consistent with NetExec's Veeam module queried stored credentials from the VeeamBackup PostgreSQL database and decrypted them with DPAPI. The number of credentials retrieved is unknown.

    Remediation

    • Apply AhsayCBS v10.3.4.45 for v10 or v9.15.2.70 for v9. Servers on v7 or v8 must first upgrade to v9.15.0.0 and then apply v9.15.2.70, and a reboot is required (ahsay.com). Hotfix downloads require a partner portal login (ahsay.com).
    • Earlier builds are insufficient: Ahsay confirmed that v9.15.2.59 and v10.3.4.0 did not fully address either CVE (kev.5sn.com).
    • Restrict access to the management interface while patching (huntress.com).
    • On any server exposed before the hotfix, hunt for unexpected JSP files in webapps\cbs and webapps\rps, requests to UpdateReceivers.do, ahsay_* and timestamp-named folders, unknown SYSTEM scheduled tasks, unexpected Defender exclusions, and an embedded Python install launched from a Run key.
    • If compromise is confirmed, re-image from a trusted backup and rotate every credential stored on or reachable from the server, including those saved in AhsayCBS and other backup software on the network.
    • The public research did not surface a public repository, pull request or commit for the fix, which Ahsay distributes as hotfixes through its partner portal.