Key points
- Ahsay issued hotfixes on 12 October 2026 for CVE-2026-105133 and CVE-2026-105134.
- The first flaw allows unauthenticated access to API endpoints via a specific JSON flag.
- The second flaw enables remote code execution through path traversal in the replication receiver.
Ahsay released hotfixes on 12 October 2026 to address two vulnerabilities in its on-premises backup server application, AhsayCBS. According to Horizon3.ai, these flaws can be chained to allow attackers to create administrator accounts and achieve remote code execution. Huntress reported earlier that this exploitation chain was already being used in the wild against production systems.
In plain English
The first issue, CVE-2026-105133, is an authentication bypass in the application’s API components. Horizon3.ai researchers found that sending a specific flag in a JSON request tricks the server into skipping credential checks. This allows anyone with network access to interact with administrative functions without logging in.
The second issue, CVE-2026-105134, involves a file write path traversal. Attackers use the unauthenticated access from the first flaw to configure a replication receiver. They then exploit the second flaw to upload malicious files, such as JSP webshells, into the application’s filesystem.
The background
Huntress published a report on 8 August 2026 detailing the in-the-wild exploitation of AhsayCBS. The report described how attackers were writing webshells into the application filesystem. This allowed them to execute commands with SYSTEM privileges on Windows servers and root privileges on Linux servers. Ahsay responded by releasing the hotfixes several weeks later.
What changes now
Organizations running AhsayCBS must apply the latest hotfixes immediately. The vulnerabilities affect the core web application components, including the Replication Receiver service. Because the flaws allow unauthenticated remote code execution, any instance exposed to the internet or internal networks is at risk. Delaying the update leaves the system vulnerable to full compromise.
Who needs to act first
Teams should prioritize updating AhsayCBS instances that are accessible from untrusted networks or the internet. Before applying the hotfix, verify the current version against the vendor’s release notes to ensure compatibility. Back up the existing configuration and database to allow for a quick rollback if the update causes issues. Test the patch in a staging environment first to confirm that backup jobs continue to function correctly after the change.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe
- Check your inventory for any servers running AhsayCBS and verify their current version status.
- Review network access controls to restrict access to the Ahsay
Step-by-step guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
