Ahsay AhsayCBS: Improper authentication in API
Deadline for US federal agencies: 17 Oct 2026
Summary
AhsayCBS, the management console for Ahsay backup software that is mainly used by MSPs and system integrators, has an improper authentication flaw in the API component (checkSysPwd). A remote, unauthenticated attacker can bypass the password check and reach JSON API actions. The flaw is exploited in the wild and is chained with CVE-2026-105134, an OS command injection that can lead to code execution as SYSTEM or root, giving access to backup data and recovery operations.
Affected
- AhsayCBS up to 9.15.2.69 and 10.3.4.44 (NVD description)
- Huntress reports that 10.3.4 remained vulnerable
- Exact affected v7 and v8 builds: Unknown. Ask Ahsay before assuming a version is safe.
Fixed in
- AhsayCBS v10: hotfix 10.3.4.45 (partner portal login required)
- AhsayCBS v9: hotfix 9.15.2.70 (partner portal login required)
- AhsayCBS v7 and v8: upgrade to v9.15.0.0 first, then apply 9.15.2.70
- The earlier patches (v10.3.4.0 and v9.15.2.59) did not fully fix the issue
Workaround
- Restrict the management web interface to trusted IP addresses or allow access only via VPN
- No other official workaround known
Exploitation
- Exploited in the wild; Huntress observed attacks from 7 October 2026
- Public proof of concept available
- Listed in the CISA Known Exploited Vulnerabilities catalog on 14 October 2026
- Attackers deployed JSP webshells and XMRig miners
Our recommendation
- Find all AhsayCBS instances, including those operated by an MSP
- Remove direct internet access to the management interface now, or restrict it to VPN or trusted IPs
- Apply the correct hotfix and reboot the server
- Check for unexpected .jsp files under %CBS%\webapps, unknown replication receivers and unknown admin accounts
- If a server was exposed, assume compromise and consider reinstalling the OS, then AhsayCBS and the hotfix
- Rotate credentials stored on or accessible from the backup server
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
horizon3ai/AhsayCBS-Auth-Bypass-RCE
Research sources
- Ahsay: Update on CVE-2026-105133 and CVE-2026-105134 patch www.ahsay.com
- Huntress: AhsayCBS flaws exploited in the wild www.huntress.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- Horizon3.ai: CVE-2026-105133 and CVE-2026-105134 horizon3.ai
- Horizon3.ai: Technical analysis of AhsayCBS CVE-2026-105133 and CVE-2026-105134 horizon3.ai
- VulDB: CVE-2026-105133 vuldb.com
- Rapid7: CVE-2026-105133 www.rapid7.com
- Tenable: CVE-2026-105133 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:45.
Original description (NVD)
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (7)
- https://vuldb.com/cve/CVE-2026-105133
- https://vuldb.com/submit/942688
- https://vuldb.com/vuln/413350
- https://vuldb.com/vuln/413350/cti
- https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.