CVE-2026-105133 - PatchNow

← Back to Overview

HIGH_RISK

Risk Level

7.3

CVSS Score

NETWORK

Attack Vector

Initial Access

ATT&CK Tactic

T1190 — Exploit Public-Facing Application

ATT&CK Technique

HIGH

Deployment Risk

Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-04

Added to CISA KEV: 2026-10-14 10 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Upgrade AhsayCBS to version 10.3.4.0 or later. Active exploitation is confirmed in the wild. Treat this as an emergency patch, not a scheduled update.
CRITICAL — CHECK FOR COMPROMISE FIRST: Before patching, investigate for indicators of compromise. Look for unexpected webshell files in the AhsayCBS web root directory, unauthorized API calls in server logs, XMRig or other cryptominer processes running on the server, and unexpected outbound network connections (especially to mining pools).
IMMEDIATE MITIGATION (if patching is delayed): Restrict access to the AhsayCBS web interface and API endpoints via firewall rules or WAF. Only permit known client IP ranges or require VPN access. This is the single most effective short-term control.
LOG REVIEW: Audit AhsayCBS access logs for anomalous API calls to ApiStructsAction endpoints, especially requests manipulating the 'random' parameter in the checkSysPwd function. Look for 200 OK responses from unauthenticated or unexpected source IPs.
CHAIN AWARENESS: Patch CVE-2026-105134 (command injection) simultaneously — both vulnerabilities are being chained together for RCE. Patching only one leaves significant residual risk.
ENDPOINT MONITORING: Deploy or verify endpoint detection on the AhsayCBS host server for process creation anomalies (e.g., Java spawning shell processes), new files in web-accessible directories, and network connections to known cryptominer pools.
NETWORK SEGMENTATION: Even post-patch, restrict AhsayCBS administrative console access to specific administrator IP ranges. Client backup agents may need broader access, but admin functions should be strictly access-controlled.
PATCH VERIFICATION: Vendor communications indicate initial patches may not have fully resolved the issue. Confirm you are running v10.3.4.0 specifically and check the Ahsay official support portal for any subsequent advisories or hotfixes.
BACKUP DATA INTEGRITY: If compromise is suspected, verify the integrity of backup data stored on the server, as a compromised backup console could be used to tamper with or exfiltrate backup data from all connected clients.
PATCH PRIORITY: CRITICAL — Immediate action required (within 24–48 hours for internet-facing instances). Do not defer to next maintenance window given confirmed active exploitation.

🔍 Web Intelligence (Kagi · 2026-10-14)

Summary

CVE-2026-105133 is a critical authentication bypass vulnerability affecting the `checkSysPwd` function within the `ApiStructsAction` component of Ahsay AhsayCBS backup software (versions up to 10.3.2). The flaw stems from improper authentication handling, allowing an attacker to manipulate the `random` argument to bypass security checks. This vulnerability is highly significant because it is currently being actively exploited in the wild, often chained with other flaws to gain unauthenticated remote code execution and facilitate malicious activities such as the deployment of webshells and cryptominers.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild by threat actors to compromise backup consoles.
Threat Actors: Exploitation has been linked to the deployment of webshells and XMRig cryptominers.
Proof-of-Concept/Exploit Tools: While specific public exploit scripts are actively being used by attackers in the field, the vulnerability is being leveraged in conjunction with CVE-2026-105134 (a command injection flaw) to achieve full remote code execution.
Attack Prerequisites: This is a remote, unauthenticated vulnerability that does not require user interaction, making it highly dangerous for internet-facing installations.

Affected Products & Patches

Affected Versions: Ahsay AhsayCBS versions up to 10.3.2 are confirmed to be vulnerable.
Patch Availability: Patches were initially released (v9.15.2.59 and v10.3.4.0), but recent vendor communications indicate these may not have fully resolved the issue. Users should consult the official Ahsay support portal for the most recent updates and verification of complete remediation ^[1].
Mitigations: Organizations with internet-facing AhsayCBS instances should restrict access to the backup management console via VPN or firewall rules to prevent unauthorized remote connections while patching is finalized.

Impact

Access/Capabilities: Successful exploitation grants an attacker unauthorized access to the system's API endpoints, which can lead to complete administrative control over the backup server when chained with other vulnerabilities.
Business Risk: For internet-facing deployments, this vulnerability presents a severe risk as it allows attackers to compromise sensitive backup data, deploy persistent backdoors (webshells), or use the infrastructure for resource-intensive malicious tasks like cryptomining.

Sources

Immediate Action Required for CVE-2026-105133 and ...
We would like to inform you that our previous patches v9.15.2.59 and v10.3.4.0 did not fully address the following security vulnerabilities:…

🔴 CVE-2026-105133