SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
13 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-105133 · CVE-2026-105134 · CVSS 10.0

AhsayCBS: 2 flaws used in attacks; attackers can get in without a password

AFFECTSAhsayCBS

OFFICIAL NAMES: Ahsay AhsayCBS Command Injection Vulnerability · Ahsay AhsayCBS Improper Authentication Vulnerability

WHAT IT IS · SERVERS AND BACKUPSIt runs or protects many systems at once, including your backups.

DO THIS FIRSTPatch it and keep its admin access off the internet. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 38 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 84%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    CVE-2026-105134 discussed publicly (CIRCL sighting). CVE-2026-105134 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-105133 reported (CIRCL sighting). Exploitation of CVE-2026-105134 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-105134 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 10 days after disclosure. CISA listed it 10 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 17, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. OCT 3, 2026
    CISA Vulnrichment marks CVE-2026-105133 as actively exploited
  2. Attack activity. OCT 3, 2026
    CISA Vulnrichment marks CVE-2026-105134 as actively exploited
  3. OCT 5, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-105134
  4. Attack activity. OCT 13, 2026
    Ahsay AhsayCBS Command Injection Vulnerability
  5. Attack activity. OCT 13, 2026
    Ahsay AhsayCBS Improper Authentication Vulnerability
  6. OCT 14, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-105133
  7. OCT 21, 2026
    Vulnerability CVE-2026-105133 confirmed by a researcher (CIRCL sighting)
  8. OCT 26, 2026
    Vulnerability CVE-2026-105134 confirmed by a researcher (CIRCL sighting)
  9. NOV 1, 2026
    CVE-2026-105133 discussed publicly (CIRCL sighting) (7 reports, latest NOV 10)
  10. NOV 1, 2026
    CVE-2026-105134 discussed publicly (CIRCL sighting) (10 reports, latest NOV 10)
  11. NOV 10, 2026
    Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
  12. Attack activity. NOV 10, 2026
    Exploitation of CVE-2026-105133 reported (CIRCL sighting)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: AhsayCBS - JSON API Authentication Bypass, OCT 24
  2. [2] nuclei-templates: Nuclei scan template: AhsayCBS <= 10.3.4 - Unauthenticated RCE, OCT 27
  3. [3] CIRCL Vulnerability-Lookup sightings: CVE-2026-105134 discussed publicly (CIRCL sighting), NOV 10
  4. [4] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-105133 reported (CIRCL sighting), NOV 10
  5. [5] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-105134 reported (CIRCL sighting), NOV 10
  6. [6] The Hacker News: Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor, NOV 10
  7. [7] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-105133, OCT 14
  8. [8] CISA Known Exploited Vulnerabilities: Ahsay AhsayCBS Command Injection Vulnerability, OCT 13
  9. [9] CISA Known Exploited Vulnerabilities: Ahsay AhsayCBS Improper Authentication Vulnerability, OCT 13
  10. [10] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-105134, OCT 5
  11. [11] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-105134 as actively exploited, OCT 3
  12. [12] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-105133 as actively exploited, OCT 3
  13. [13] CIRCL Vulnerability-Lookup sightings: 18 more reports