Skip to content
Critical RCE Vulnerabilities in AhsayCBS Exploited

Critical RCE Vulnerabilities in AhsayCBS Exploited

First seen 15 Oct 2026, 09:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 10:36 UTC

CVE-2026-105133 and CVE-2026-105134 affect AhsayCBS (Cloud Backup Server), allowing attackers to bypass authentication and execute code on exposed servers. CVE-2026-105133, with a CVSS score of 7.3, enables unauthenticated access to the JSON API, while CVE-2026-105134, rated 10.0, allows remote code execution through a path traversal vulnerability. Both vulnerabilities were confirmed to be, with attackers using JSP webshells and cryptocurrency miners. The vulnerabilities were added to the CISA KEV list on 2026-10-14, indicating ongoing exploitation. AhsayCBS versions 10.3.4 and earlier are affected, and immediate patching is recommended to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-04
CVE-2026-105133 and CVE-2026-105134 published
Both vulnerabilities were disclosed, with CVE-2026-105134 rated as critical with a CVSS score of 10.0.
Horizon3.Ai
2026-10-05
First public PoC for CVE-2026-105134
Proof-of-concept code for the critical vulnerability was made publicly available.
github.com
2026-10-14
CVE-2026-105133 and CVE-2026-105134 added to CISA KEV
CISA confirmed active exploitation of both vulnerabilities, adding them to the Known Exploited Vulnerabilities catalog.
Horizon3.Ai

More articles in this cluster (4)

Following this threat?

Track CVE-2026-105133 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which AhsayCBS versions are affected?
AhsayCBS versions 10.3.4 and earlier are vulnerable to these exploits.
What is the current exploitation status?
Both CVEs are actively exploited in the wild, as confirmed by multiple sources.
What immediate actions should be taken?
Apply the latest Ahsay hotfix and restrict management access while completing remediation.