AhsayCBS: Auth Bypass Plus One Receiver Call Equals SYSTEM (CVE-2026-105133 + CVE-2026-105134)
your MSP’s backup console is supposed to be the thing that saves you after ransomware. instead, for a stretch of October 2026, exposed AhsayCBS boxes were handing unauthenticated attackers SYSTEM on a chain so short it fits in two HTTP calls. Huntress watched webshells and XMRig miners disguised as Microsoft Edge drop within hours of NVD publishing the CVEs. the hotfixes exist. the question is whether the backup server that holds your backups got them.
10.10.0.50, build intentionally unpatched for the exercise). do not send checkSysPwd bypasses or UpdateReceivers calls at any backup console you do not own and have written authorization to test. this is detection engineering and authorized red team practice. CISA added both CVEs to KEV on October 14, 2026.the two bugs, in order
CVE-2026-105133 is an authentication bypass in checkSysPwd inside com/ahsay/obs/api/ApiStructsAction.java. the password check can be skipped when a request carries a specific flag, so the console’s API treats you as authenticated without anything resembling credentials. medium severity on paper. in practice it is the front door.
CVE-2026-105134 is a critical flaw in the Replication Receiver API at /rps/api/json/UpdateReceivers.do. after the bypass (or with a crafted random token substituting for valid credentials), an attacker can configure a malicious receiver and get operating system command execution as NT AUTHORITY\SYSTEM, including writing a JSP webshell into a directory the CBS application serves. Huntress and Ahsay both describe the chain the same way: 105133 to get in, 105134 to own the host.
affected builds include AhsayCBS v10 through 10.3.4.0 (hotfix is 10.3.4.45) and v9 before 9.15.2.70. v7 and v8 need an upgrade to v9 first. the management interface being reachable from the internet is the real accelerant.
step 2: the receiver call that writes the shell
with the bypass in hand, the lab hits UpdateReceivers and asks the Replication Receiver path to drop a benign marker JSP into the webapps directory. on a vulnerable build this lands as SYSTEM. on a hotfixed build it fails closed. Huntress saw real attackers use the same path to drop randomly named JSPs, then run recon, then plant XMRig pretending to be Edge, plus a delightfully unhinged PowerShell script that watches Task Manager at night and kills it if it stays open too long.
what Huntress actually saw in the wild
- exploitation starting October 7, 2026 at 23:20 UTC, three days after NVD disclosure.
- child processes spawning from
cbssvcX64.exethat have no business being there. - JSP webshells with random names under
%CBS%\webapps, plus short random folder names. - unauthorized RPS receivers and unexpected Admin-type AhsayCBS user accounts.
- strange folders at drive roots (
ahsay_ts,ahsay_t8,srv,opt, and friends). - XMRig miners and an AI-flavored Task Manager babysitter script.
Ahsay’s own guidance is blunt: if you see those indicators, treat the server as compromised and rebuild. restore configuration from an Auto Save that predates the intrusion by at least a day. do not try to surgically clean a backup console that attackers used as a foothold into the rest of the estate.
the fix, which is a hotfix and a network decision
- v10: apply hotfix 10.3.4.45 and reboot.
- v9: apply hotfix 9.15.2.70 and reboot.
- v7/v8: upgrade to 9.15.0.0, then apply 9.15.2.70.
- take the management interface off the public internet. VPN or allowlisted admin networks only.
- alert on child processes of
cbssvcX64.exe, on new files under webapps, and on new RPS receivers.
backup infrastructure is crown jewel territory. an unauthenticated path from the internet to SYSTEM on the box that holds your backups is not a medium finding with a critical sibling. it is a single story: patch the hotfix, hide the console, and assume any exposed unpatched CBS from early October needs a rebuild, not a shrug.
