CISA adds two actively exploited AhsayCBS flaws to KEV catalog

CISA added two chained AhsayCBS vulnerabilities, CVE-2026-105134 and CVE-2026-105133, to its Known Exploited Vulnerabilities catalog on October 14. Federal agencies have until October 17 to apply mitigations or stop using the product.

CVE-2026-105134 is a command injection flaw. A remote attacker can run operating system commands by manipulating the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. VulDB, the CVE numbering authority, rates it 10.0 under CVSS 3.1. NVD has not scored it.

CVE-2026-105133 bypasses authentication. The flaw sits in the API component’s checkSysPwd function and is also triggered through the random parameter. VulDB rates it 7.3 under CVSS 3.1. Both flaws affect AhsayCBS up to version 10.3.2.

Attackers are chaining the two. Huntress reported on October 8 that it began seeing exploitation on October 7 and had seen five organizations targeted. Attackers used the authentication bypass to get in, then ran commands as SYSTEM, configured a malicious receiver, dropped JSP webshells and planted XMRig cryptominers, according to Huntress.

Ahsay says its first patches fell short. In an October 12 update, Ahsay said patches v9.15.2.59 and v10.3.4.0 did not fully fix the flaws. It told partners to apply hotfix v10.3.4.45 on v10 and hotfix v9.15.2.70 on v7 through v9.

CISA’s order covers federal agencies. Under BOD 26-04, agencies must apply vendor mitigations, follow CISA’s forensics triage requirements for CVE-2026-105134, or discontinue the product if mitigations are unavailable.