flawopen.com/Incidents/ahsaycbs-auth-bypass-command-injection-october-2026
AhsayCBS: Authentication Bypass Chained to Command Injection
As of 2026-10-12, Huntress reports AhsayCBS through 10.3.4 affected and observed attacks beginning October 7. Ahsay now says earlier fixes 10.3.4.0 and 9.15.2.59 did not fully address both flaws; it directs v10 partners to hotfix 10.3.4.45 and v7–v9 partners to 9.15.2.70, followed by a reboot. The partner-only hotfix details were not independently reviewed, so confirm the installed build and follow Ahsay’s current instructions.[1], [8], [3], [4]
Imagine a visitor slipping past the backup-room identity check, then writing a note for the operator. The receiver endpoint treated attacker-controlled input as part of an operating-system command, so the note could be interpreted as an instruction instead of data. The analogy describes Huntress's reported chain; the exact Ahsay implementation is not public.[1], [3], [4]
Core Concepts & Subsystem Terms
CVE-2026-105133- A medium-severity improper-authentication flaw reported in AhsayCBS's
checkSysPwdfunction. Huntress describes it as the first step in the observed chain.[3], [1] CVE-2026-105134- A Critical, CVSS 10.0 OS command-injection flaw reported in the Replication Receiver API at
/rps/api/json/UpdateReceivers.do. Huntress says it enabled code execution after the authentication bypass. The 10.0 score applies to this CVE, not both flaws.[4], [1] Patch status as of 12 October 2026- The CVE records initially listed 10.3.4 as fixed, and Huntress later found versions through 10.3.4 affected. Ahsay's October 10 and October 12 announcements supersede its October 9 position: earlier fixes 10.3.4.0 and 9.15.2.59 did not fully address both flaws. Ahsay directs v10 partners to 10.3.4.45 and v7–v9 partners to 9.15.2.70, followed by a reboot. These are vendor instructions; partner-only hotfix contents and effectiveness were not independently reviewed.[1], [8], [3], [4]
Framework mappings
Version status and defensive action
| Evidence source | What it says | Operator decision |
|---|---|---|
| CVE records (4 Oct) | Initially list 10.3.4 as fixed for the two CVEs. | Treat this as disputed; verify the fix directly with Ahsay before closing remediation. |
| Huntress (8 Oct) | Reports exploitation and says versions through 10.3.4 were also affected. | Treat systems through 10.3.4 as potentially affected; restrict management access and investigate. |
| Ahsay v10.3.4 release notes (5 Aug) | Name neither CVE or a security fix for either flaw. | Do not infer that 10.3.4 fixed these CVEs from the release notes alone. |
| Ahsay v10.3.2 release notes (20 Jul) | List a generic “Ahsay Security Patchset - 2026/Q3” but do not identify these CVEs or a fixed version. | Do not treat the generic patchset label as proof these CVEs are fixed. Huntress later reported v10.3.4 affected. |
| Suspected compromise at any version | A version number does not rule out earlier exploitation or persistence. | Investigate the host, preserve evidence, assess backup integrity, and use trusted recovery procedures. |
| Ahsay announcements (10 and 12 Oct) | Earlier fixes 10.3.4.0 and 9.15.2.59 did not fully address both flaws. Ahsay directs v10 partners to 10.3.4.45 and v7–v9 partners to 9.15.2.70, then reboot. | Follow the version-specific vendor instruction, reboot, and verify the installed build through the partner channel; the hotfix contents were not independently inspected. |
Incident Timeline
Huntress began observing exploitation of the flaws against exposed systems.[1]
Huntress reported five organizations targeted and corrected its earlier version assessment: it found 10.3.4 affected too.[1]
As of publication on October 9, no vendor-confirmed fixed version had been identified.[5]
Ahsay announced that v10.3.4.0 did not fully address both flaws and directed v10 partners to hotfix 10.3.4.45.[8]
Ahsay updated its guidance: v10 partners should apply 10.3.4.45; v7–v9 partners should apply 9.15.2.70. Reboot after either hotfix.[8]
Step-by-Step Attack Flow
An exposed management interface is reachable
Huntress says the observed activity targeted internet-accessible AhsayCBS web interfaces. It reported that the product is used by managed service providers and system integrators.[1]
The Replication Receiver flaw provides code execution
Huntress links CVE-2026-105134 to command injection in /rps/api/json/UpdateReceivers.do. It reports attackers configured a receiver and placed JSP webshells in the application's served directory. No request syntax or payload is reproduced here.[1], [4]
Source Code: Flaw vs. Secure Implementation
The secure example uses a fixed executable, an explicit allowlist, and separate ProcessBuilder arguments; it does not invoke a shell or concatenate user input into a command string. This is a generic defensive pattern showing how to close the OS-command parsing boundary, not Ahsay source or its patch. The public sources reviewed do not expose the vendor implementation or fix.[1], [3], [4]
// Generic anti-pattern only; not Ahsay source.
void updateReceiver(Request request) {
String receiver = request.parameter("receiver");
String command = commandBuilder.forReceiverUpdate(receiver);
operatingSystem.execute(command); // unsafe command-string boundary
}
// Generic defensive design only; not an Ahsay patch.
private static final Set<String> ALLOWED_RECEIVERS = Set.of("primary", "archive");
void updateReceiver(Principal principal, ReceiverInput input) throws IOException {
authorization.require(principal, Permission.MANAGE_RECEIVERS);
String receiver = input.receiverId();
if (!ALLOWED_RECEIVERS.contains(receiver)) {
throw new IllegalArgumentException("Unsupported receiver");
}
new ProcessBuilder("/usr/local/bin/replication-tool", "update", "--receiver", receiver)
.start(); // fixed executable; separate arguments; no shell
}
Engineering & System Hardening Checklist
- ✓Treat versions through 10.3.4 as potentially affected based on Huntress’s findings. Ahsay now directs v10 partners to hotfix 10.3.4.45 and v7–v9 partners to 9.15.2.70, followed by a reboot; the partner-only hotfix contents were not independently reviewed. Confirm the installed build with Ahsay before declaring remediation complete.
- ✓Until the version-appropriate Ahsay hotfix is installed and verified, restrict the management interface to trusted administrator networks or a VPN. Do not expose it directly to the internet.
- ✓Use Huntress's published Sigma detections as starting points: unexpected child processes from AhsayCBS services, Edge-named daemonized binaries, Task Manager-aware service control, and WinRing0 driver downloads. Tune against the documented baseline and correlate alerts; the rules are campaign-specific and can produce false positives.
- ✓Review endpoint telemetry for unexpected child processes from AhsayCBS services, new web application files, and newly created services. Treat these as investigation leads, not proof by themselves.
- ✓If evidence supports compromise, follow incident-response procedures, preserve relevant logs, assess backup integrity, and rebuild from a trusted source where appropriate. Rotate credentials from a clean environment.
- ✓After applying the vendor-directed hotfix, verify the installed build and reboot status with Ahsay; separately investigate possible earlier compromise because patching does not establish that the host was never accessed.
Sources
- Huntress — AhsayCBS exploitation analysis and October 8 update
- Ahsay — AhsayCBS v10.3.4 release notes
- CVE-2026-105133 record
- CVE-2026-105134 record
- BleepingComputer — AhsayCBS flaws exploited in attacks
- Huntress — AhsayCBS campaign Sigma detections
- Ahsay — AhsayCBS v10.3.2 release notes
- Ahsay — October 10 and 12, 2026 hotfix announcements