AhsayCBS Hotfixes Address Auth Bypass and RCE Chain Exploited In-The-Wild

Ahsay released hotfixes on October 12, 2026, addressing two vulnerabilities in AhsayCBS that allow attackers to gain remote code execution on backup servers. These flaws, tracked as CVE-2026-105133 and CVE-2026-105134, were actively exploited in the wild, according to a report from Huntress published in August 2026.

Horizon3.ai researchers reverse-engineered the vulnerabilities to demonstrate how an authentication bypass and a path traversal flaw can be chained. By exploiting these issues together, attackers can create administrator accounts and upload JavaServer Pages (JSP) webshells. This chain allows them to execute commands with SYSTEM or root privileges on the affected server.

Technical Analysis of the Vulnerabilities

CVE-2026-105133 is an authentication bypass within the API components of the AhsayCBS application. The vulnerability exists in the JSONApi base class, which handles authentication decisions before executing specific actions. According to Horizon3.ai, the authentication logic relies on three boolean values to determine if credentials are required.

The checkSysPwd() function, which validates system administrator usernames and passwords, is only called when all three booleans are false. However, an attacker can set the "FromServlet" flag to "Y" in the JSON request body. This action sets the equals boolean to true, causing the server to skip the credential validation step entirely.

With the API effectively unauthenticated, attackers can access endpoints that modify system settings. Specifically, they can use the AddSysUser endpoint to create new administrative users. The AddSysUser handler does not consult the authenticated caller, allowing an unauthenticated attacker to mint themselves an administrator account using attacker-supplied JSON data.

Exploitation Chain and Impact

The second vulnerability, CVE-2026-105134, is a file write path traversal that leads to remote code execution. This flaw targets the Replication Receiver component of AhsayCBS. Replication in AhsayCBS mirrors primary server data to a secondary receiver, which is configured through the UpdateReceivers endpoint.

By chaining the authentication bypass, an attacker can call UpdateReceivers.do with Id=0 to create a new V7 receiver. The attacker controls the login, password, and SystemHome settings for this receiver. This configuration allows the attacker to direct file writes into the application filesystem.

Once the webshell is uploaded, the attacker can execute commands as the SYSTEM account on Windows or root on Linux. AhsayCBS is available for installation on both Linux and Windows servers, making both platforms potentially vulnerable to this exploitation chain.

What should you do?

Organizations using AhsayCBS should immediately apply the hotfixes released by Ahsay on October 12, 2026. Administrators should verify that the patch has been successfully installed on all backup servers. Until the update is applied, monitor server logs for unauthorized administrator account creations or unusual file writes to the application directory.

What to do and how to stay safe: AhsayCBS

• Apply the AhsayCBS hotfixes released on October 12, 2026, to all instances of the backup server application.
• Monitor system logs for the creation of new administrative accounts or unexpected file uploads to the webapps directory.
• Restrict network access to the AhsayCBS management interface to trusted IP addresses only, reducing exposure to unauthenticated attacks.
• Verify that replication receiver configurations are not accessible from untrusted networks, preventing unauthorized modification of SystemHome settings.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the AhsayCBS vulnerabilities?

The vulnerabilities are tracked as CVE-2026-105133 for the authentication bypass and CVE-2026-105134 for the path traversal leading to remote code execution.

When were the hotfixes released by Ahsay?

Ahsay released hotfixes for these issues on October 12, 2026, according to the source material.

How do attackers achieve remote code execution?

Attackers chain CVE-2026-105133 and CVE-2026-105134 to bypass authentication, create admin accounts, and upload JSP webshells, allowing command execution as SYSTEM or root.