CyberSecurity News
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
AI summary
Ahsay Backup has released security updates to fix two vulnerabilities in AhsayCBS that have been exploited to deploy web shells and cryptocurrency miners. The vulnerabilities, identified as CVE-2026-105133 and CVE-2026-105134, can be chained together to bypass authentication and execute arbitrary commands on affected systems. These updates come after initial patches were found to be incomplete. The flaws have been used by attackers to drop web shells and XMRig cryptocurrency miners. AhsayCBS users are now being protected with the new fixes.
Vulnerabilities mentioned
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.