Unauthenticated API authentication bypass in AhsayCBS chained to webshell deployment (CVE-2026-105133)
Huntress published on 2026-10-08 (corroborated by BleepingComputer, The Hacker News and SecurityWeek on 2026-10-09, when VulnCheck also added the CVE to its KEV) that attackers are chaining this authentication bypass with CVE-2026-105134 to drop webshells and XMRig miners on reachable AhsayCBS servers, so a team that leaves its console exposed is handing over its backup server.
A flaw in the checkSysPwd function of the AhsayCBS API (com/ahsay/obs/api/ApiStructsAction.java) lets a remote, unauthenticated attacker manipulate the random argument to bypass authentication to the backup management server. Attackers are chaining it with the CVE-2026-105134 OS command injection to plant webshells and XMRig cryptominers on AhsayCBS hosts, giving them control of the backup infrastructure.
Affected: AhsayCBS 10.3.0; AhsayCBS 10.3.1; AhsayCBS 10.3.2
How to Test
Check the AhsayCBS version in the CBS web console or installation; versions 10.3.0, 10.3.1 and 10.3.2 are listed as affected. Review web server and API access logs for unexpected requests to the API handled by ApiStructsAction / checkSysPwd, especially with unusual values in the random parameter, and for authenticated-looking sessions from unknown source IPs. Hunt the server for webshells dropped in the web application directories and for unknown processes or binaries posing as Microsoft Edge (the reports describe XMRig miners disguised as Edge), unusual CPU consumption, and outbound connections to mining pools. Treat any such finding as a full compromise of the backup server and its stored credentials.
How to Mitigate
No vendor-confirmed fix is established: the CVE record states that upgrading to AhsayCBS 10.3.4 mitigates the issue, but Ahsay's 10.3.4 release notes (05-Aug-2026) list no security fix for it and Huntress, BleepingComputer and SecurityWeek describe the flaws as unpatched as of 2026-10-09. Upgrade to 10.3.4 as the best available step, but do not rely on it alone: immediately restrict network access to the AhsayCBS web console and API to trusted management addresses or a VPN, remove direct internet exposure, and watch for a vendor advisory explicitly addressing CVE-2026-105133 and CVE-2026-105134.