Attackers Exploit Two AhsayCBS Flaws to Gain SYSTEM Access
Summary
Researchers reported active exploitation of two AhsayCBS flaws, affecting versions through 10.3.4 at disclosure. Chained, unauthenticated attacks can give SYSTEM access; observed activity included web shells and cryptomining.
Key points
- Researchers reported exploitation on October 8, 2026; activity was first observed the previous day, and five affected organizations were identified within the first day of reporting.
- CVE-2026-105133 is an improper authentication flaw (CVSS 5.5); CVE-2026-105134 is a command-injection flaw in the Replication Receiver (CVSS 9.3).
- The flaws can be chained remotely without credentials to configure a malicious receiver, deploy a JSP web shell, and execute commands as NT AUTHORITY\SYSTEM.
- Researchers said versions through 10.3.4 remained vulnerable at disclosure; public proof-of-concept exploit code was available.
- Observed activity included reconnaissance, web shells, XMRig miners disguised as Microsoft Edge, a fake Edge update service, and PowerShell scripts to conceal mining.
- Organizations are advised to inventory deployments, restrict management and Replication Receiver access to trusted networks, upgrade to a vendor-fixed release when available, and investigate for compromise.
Article Details
- Vulnerability Types
- Improper authentication
- Operating system command injection
- Severity
- CVSS 5.5 for CVE-2026-105133 and 9.3 for CVE-2026-105134
- Affected Versions
- AhsayCBS versions through 10.3.4
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Restrict access to management interfaces and Replication Receiver services to trusted administrative networks, approved source addresses, or VPN connections.
MITRE ATT&CK
T1036 · MasqueradingXMRig miners were disguised as Microsoft Edge processes.T1059.001 · PowerShellPowerShell scripts were used to conceal cryptocurrency-mining activity.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities were used to gain unauthenticated access to exposed AhsayCBS interfaces.T1496 · Resource HijackingAttackers installed XMRig cryptocurrency miners on compromised servers.T1505.003 · Web ShellAttackers deployed JSP web shells on compromised AhsayCBS servers.T1543.003 · Windows ServiceAttackers created a fake Edge update service for persistence.
CVE
CVE-2026-105133CVE-2026-105133, an improper authentication vulnerability in the checkSysPwd function with a Common Vulnerability Scoring System (CVSS) score of 5.5.CVE-2026-105134CVE-2026-105134, an operating system command injection vulnerability in the Replication Receiver component with a CVSS score of 9.3.