Horizon3.ai on X: "CVE-2026-105133 (CVSS 3.x: 7.3) bypasses API authentication. An ...

Horizon3.ai @Horizon3ai 6h 🚨 An actively exploited Ivanti Connect Secure vulnerability allows command execution without valid credentials. CVE-2026-104935 carries a CVSS 3.1 score of 8.6 (High). Here’s how the attack works and what teams should do. 1

Horizon3.ai @Horizon3ai CVE-2026-105133 (CVSS 3.x: 7.3) bypasses API authentication. An attacker-controlled FromServlet flag causes the server to skip its credential check, exposing JSON API actions without valid credentials. 8:08 PM · Oct 15, 2026 · 50 Views 1

Horizon3.ai @Horizon3ai 6h CVE-2026-105134 (CVSS 3.x: 10.0) is a path traversal in the replication receiver’s file-upload service. Attacker-controlled headers allow writes outside the intended directory, including a JSP webshell in a web-served directory. 1 Horizon3.ai @Horizon3ai 6h The attack chain: ➡️ Bypass API authentication ➡️ Create a receiver with attacker-set credentials ➡️ Upload a JSP webshell using path traversal ➡️ Request the JSP to execute code No existing credentials required. 1 Horizon3.ai @Horizon3ai 6h Code runs with the AhsayCBS service’s privileges, demonstrated as SYSTEM on Windows and root on Linux. ⚠️ The RCE chain targets affected AhsayCBS deployments with replication receiver functionality available. 1 Horizon3.ai @Horizon3ai 6h Why it matters: AhsayCBS centralizes backup policies, storage, and user management. Compromise puts a server responsible for backup operations under attacker control, threatening critical recovery infrastructure 1 Horizon3.ai @Horizon3ai 6h And this isn't theoretical. 🔴 Exploitation observed in the wild 🔴 AhsayCBS 10.3.4.0 alone is insufficient Apply the appropriate hotfix: ➡️ v10: 10.3.4.45 ➡️ v9: 9.15.2.70 ➡️ v7/v8: Upgrade to 9.15.0.0, then apply 9.15.2.70 Reboot after applying the hotfix. 1 Horizon3.ai @Horizon3ai 6h What to do: ⚠️ Restrict management access to trusted IPs or VPN. ⚠️ Investigate webshells, unauthorized admins, and unexpected receivers. ⚠️ For compromised hosts, follow Ahsay’s rebuild guidance and restore a configuration predating compromise. Patching does not remove 1 Horizon3.ai @Horizon3ai 6h Horizon3's Attack Research team reversed both vulnerabilities. 👉 Run #NodeZero Rapid Response before and after remediation to check whether the tested attack path remains exploitable. Read Zach Hanley’s technical deep dive: AhsayCBS Auth Bypass & RCE: CVE Analysis From horizon3.ai