# Active exploit chain hits Ahsay AhsayCBS backup servers

Published: 2026-10-14 · Severity: severe
Canonical: https://vorant.io/reports/fa6a027b-544b-5c77-8e89-e2083739c7e0/active-exploit-chain-hits-ahsay-ahsaycbs-backup-servers

> Attackers are chaining an authentication bypass and OS command injection in Ahsay AhsayCBS to gain unauthenticated remote code execution; patch to 10.3.4 immediately.

NCSC-NL issued an advisory for two vulnerabilities in Ahsay's AhsayCBS backup server software (up to and including version 10.3.2) that are being actively exploited together in the wild. CVE-2026-105133 (CVSS 7.3/v4 5.5) is an authentication weakness in the checkSysPwd function of the AhsayCBS API, allowing an unauthenticated attacker to bypass authentication remotely. CVE-2026-105134 (CVSS 10.0/v4 9.3) is an OS command injection vulnerability in the Replication Receiver component, reachable via /rps/api/json/UpdateReceivers.do, enabling arbitrary OS command execution.

Researchers have observed real-world attacks combining both flaws in a single chain: the authentication bypass (CVE-2026-105133) is used first to reach the vulnerable endpoint, followed by exploitation of the command injection flaw (CVE-2026-105134) to achieve unauthenticated remote code execution on vulnerable AhsayCBS servers. Ahsay has released version 10.3.4 to remediate both issues and lists indicators of compromise including suspicious directories/files, unauthorized RPS (Replication) receivers, and unauthorized AhsayCBS accounts with administrative privileges.

NCSC-NL urges organizations to apply the update urgently and to investigate for prior compromise using the listed indicators. If compromise is found, Ahsay and NCSC recommend fully rebuilding the server and restoring from a known-good, pre-compromise configuration rather than simply patching in place, given the risk of persistent backdoor access via rogue admin accounts or receivers.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105133 (KEV), CVE-2026-105134 (KEV)

## Detection guidance (public sample)

### Request to AhsayCBS Replication Receiver UpdateReceivers Endpoint

ATT&CK: T1190

Detects POST requests to the AhsayCBS /rps/api/json/UpdateReceivers.do endpoint, the command injection entry point of the actively exploited auth-bypass plus RCE chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Request to AhsayCBS Replication Receiver UpdateReceivers Endpoint
id: 72ea1b78-b0a4-5b63-a9e1-b8c122e6d64f
status: experimental
description: Detects POST requests to the AhsayCBS /rps/api/json/UpdateReceivers.do
  endpoint, the command injection entry point (CVE-2026-105134) chained with the checkSysPwd
  authentication bypass (CVE-2026-105133). Legitimate use is rare and limited to admins
  configuring replication receivers, so review the source IP and any follow-on child
  processes of the AhsayCBS Java service.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /rps/api/json/UpdateReceivers.do
    cs-method: POST
  condition: selection
falsepositives:
- Backup administrators legitimately configuring replication receivers from a management
  network
- Authorised vulnerability scanning or penetration tests against AhsayCBS
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0427.html
```

### AhsayCBS Java Process Spawning Command Interpreter

ATT&CK: T1059

Detects the AhsayCBS Java service spawning a shell or scripting interpreter, indicating OS command injection (for example via the Replication Receiver) leading to RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AhsayCBS Java Process Spawning Command Interpreter
id: 156ad0bd-6794-5264-a91a-cb3d26fd6ac0
status: experimental
description: Detects a Java process running from an AhsayCBS install directory spawning
  cmd, PowerShell, or other script and download interpreters. This is consistent with
  exploitation of the AhsayCBS Replication Receiver OS command injection. Generalises
  on the parent/child relation, not on payload strings.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: AhsayCBS
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Custom backup pre/post-backup scripts launched through cmd.exe by the AhsayCBS service
- Administrator-run maintenance or upgrade scripts started by the AhsayCBS Java service
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0427.html
```

### Local Account Creation by AhsayCBS Java Process

ATT&CK: T1136.001

Detects net.exe or net1.exe adding a local user where the parent is the AhsayCBS Java service, indicating post-exploitation persistence through rogue accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local Account Creation by AhsayCBS Java Process
id: 25f22bfb-6cca-5a3f-9c82-e23687dac0ff
status: experimental
description: Detects net user /add executed by a Java process from an AhsayCBS install
  directory. After exploiting the AhsayCBS RCE chain, attackers may create rogue accounts
  for persistent access. The AhsayCBS service has no legitimate need to create OS
  accounts.
tags:
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: AhsayCBS
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - user
    - /add
  condition: selection
falsepositives:
- Highly unlikely; a custom admin script run through the AhsayCBS service that provisions
  a local service account
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0427.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0427.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fa6a027b-544b-5c77-8e89-e2083739c7e0/active-exploit-chain-hits-ahsay-ahsaycbs-backup-servers.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup