Search — “CVE-2026-105134”

Huntress analyzed three Windows AhsayCBS servers breached Oct 8-11, 2026 via an auth bypass and unauthenticated SYSTEM RCE through /rps/api/json/UpdateReceivers.do. The operator planted five JSP webshell families (including a PNG-steganography loader and a signed-API shell), an XMRig miner relaunched by a SYSTEM scheduled task every minute, a MachineGuid-keyed Python implant launched from a Run key, tunneling tools (gost, chisel), RMM tools, Defender exclusions, and a NetExec-style Veeam credential query. Hunt for cbssvcX64.exe spawning cmd.exe, new .jsp files in webapps\cbs and webapps\rps, ahsay_* and Linux-style folders at the drive root, the kvm task, and python.exe under the SYSTEM profile.

Two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, were chained to bypass authentication and execute arbitrary commands, and were exploited to drop web shells and XMRig cryptominers, per Huntress. Earlier patches in versions 9.15.2.59 and 10.3.4.0 were incomplete, and Ahsay has released hotfixes v10.3.4.45 and v9.15.2.70 that should be applied followed by a server reboot. CISA added the flaws to KEV with a federal remediation deadline of October 17, 2026. Hunters should look for web shells and XMRig activity on exposed AhsayCBS servers, though the source does not print specific file paths or command lines.