Critical Authentication Bypass & Remote Code Execution in AhsayCBS (CVE‑2026‑105133, CVE‑2026‑105134)
What It Is – Two newly disclosed flaws in AhsayCBS allow an attacker to bypass authentication and execute arbitrary OS commands. The vulnerabilities were observed in the wild, where threat actors dropped web shells and XMRig cryptocurrency miners on compromised backup servers.
Exploitability – Active exploitation has been reported; proof‑of‑concept code is publicly available. Both CVEs carry a CVSS v3.1 base score of 8.8 (High).
Affected Products – Ahsay Backup’s on‑premises AhsayCBS (all versions prior to the October 2026 security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls are enforced across critical backup infrastructure.
- Highlights the importance of maintaining up‑to‑date evidence of patch status as part of a defensible audit trail.
- Shows that a single control gap (identity & access management) can undermine multiple compliance frameworks, prompting buyers to demand real‑time assurance of access controls.
Recommended Actions
- Deploy the October 2026 patches for CVE‑2026‑105133 and CVE‑2026‑105134 immediately.
- Verify the integrity of all AhsayCBS instances (checksums, file‑system scans) to ensure no web shells remain.
- Enable strict logging of authentication attempts and command‑execution events; forward logs to a SIEM for continuous monitoring.
- Review and tighten least‑privilege assignments for backup service accounts.
- Document the remediation steps in your control‑evidence repository to support audit readiness.
Source: The Hacker News