Back to Fastnexa
Under attack?
CyberBrief
Subscribe
Fastnexa

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Used in attacksCriticalCVSS 10.0The Hacker News · info@thehackernews.com (The Hacker News)·

At a glance

Severity
CriticalCVSS 10.0
Used in attacks
Yes, 2 of 2 flaws named
Flaws named
CVE-2026-105133CVE-2026-105134
Reported by
1 outlet

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier…

Read the full story at thehackernews.com ↗Established Source

We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.

Vulnerabilities referenced

  • CVE-2026-1051337.3High

    Ahsay AhsayCBS

    Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

    Used in attacks

    Added to CISA's list 2026-10-14

    Full record →
  • CVE-2026-10513410.0Critical

    Ahsay AhsayCBS

    Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

    Used in attacks

    Added to CISA's list 2026-10-14

    Full record →

Fastnexa security experts

This story involves a flaw attackers are already using. Are you exposed?

A Fastnexa penetration tester can check whether CVE-2026-105133, CVE-2026-105134 or anything like them can be used against your websites, apps and network.

Book a 30-min callWhatsApp us

Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →

Coverage

One outlet has carried this so far.

  1. The Hacker News ↗Established SourceFirst reported

    2026-10-15 06:43 UTC

Related stories