Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2026-105133

ahsaycloud backup suite

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

VTP deterministic threat34.7of 100 · CVSS excluded

VTP analyst assessment

AhsayCBS authentication bypass

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateCANDIDATE CREATED
AI priorityHIGH
AI confidence83%
Public exploitation · VTP factKEV

Assessment

Press reporting says attackers exploit this AhsayCBS flaw with CVE-2026-105134 to deploy web shells and XMRig miners. The flaw allows remote authentication bypass through manipulation of the API's random argument. Version 10.3.4 mitigates it.

Why it matters

  • AhsayCBS manages backup operations, making its administrative access valuable.
  • The reported chain can bypass authentication before command execution through the paired flaw.

Evidence

3 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The reporting attributes web-shell and miner deployment to the combined vulnerability chain, not this CVE alone.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use AhsayCBS through 10.3.2, upgrade to 10.3.4 and review exposed API access.

AI baseline history (6)
  1. BASELINE ASSESSED
    AhsayCBS authentication bypassgpt-5.6-terra · low
  2. BASELINE ASSESSED
    AhsayCBS authentication bypass used in attack chainsgpt-5.6-terra · low
  3. BASELINE ASSESSED
    AhsayCBS authentication bypass is reportedly exploitedgpt-5.6-terra · low
  4. BASELINE ASSESSED
    AhsayCBS authentication flaw reportedly used for webshell and cryptomining deploymentgpt-5.6-terra · low
  5. BASELINE ASSESSED
    AhsayCBS API authentication bypass reportedly exploitedgpt-5.6-terra · low
  6. BASELINE ASSESSED
    AhsayCBS API improper authenticationgpt-5.6-terra · low
Technical severityMEDIUMCVSS 5.5 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0158th percentile · prediction
Evidence confidence60%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    EPSS is 0.01; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

5publications detected
5underlying evidence chains

0 primary sources · 0 dependent secondary reports · 5 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:d86b06191abb1518b613cc54581d300a3cb75d458d157e727a194b96c9838d98ACTIVE
Evidence
04

Event history

Threat timeline

  1. 00:0014 Oct
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

  2. 17:1709 Oct
    EXPLOITATION REPORTED

    Exploitation Reported

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier

CVE-2026-105133CVE-2026-105134
Separate evidence group
Original
The Hacker NewsPRESSUNKNOWN

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.

CVE-2025-64393CVE-2026-102255CVE-2026-102404CVE-2026-102406CVE-2026-102413CVE-2026-102489CVE-2026-102490CVE-2026-103008CVE-2026-104711CVE-2026-104712CVE-2026-104713CVE-2026-104714CVE-2026-105133CVE-2026-105134CVE-2026-105192CVE-2026-106197CVE-2026-106347CVE-2026-106358CVE-2026-106382CVE-2026-18397CVE-2026-20328CVE-2026-21589CVE-2026-32740CVE-2026-47483CVE-2026-58069CVE-2026-59265CVE-2026-63277CVE-2026-76268CVE-2026-76281CVE-2026-76282CVE-2026-76284CVE-2026-76454CVE-2026-76455CVE-2026-76459CVE-2026-76464CVE-2026-76465CVE-2026-76471CVE-2026-76480CVE-2026-76482CVE-2026-76483CVE-2026-76485CVE-2026-76486CVE-2026-76498CVE-2026-76499CVE-2026-76500CVE-2026-76501CVE-2026-84388CVE-2026-85097CVE-2026-86360CVE-2026-86361CVE-2026-86362CVE-2026-91140CVE-2026-93355CVE-2026-93836CVE-2026-94504CVE-2026-96940
Separate evidence group
Original
BleepingComputerPRESSUNKNOWN

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]

CVE-2026-105133CVE-2026-105134
Separate evidence group
Original
The Hacker NewsPRESSUNKNOWN

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"

CVE-2026-105133CVE-2026-105134
Separate evidence group
Original
SecurityWeekPRESSUNKNOWN

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. The post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek .

CVE-2026-105133CVE-2026-105134
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score34.7vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction0.17 / 20
Exploit availability2.5 / 15
Source independence0 / 15
Intelligence recency2 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-287
CPE records
1
Deterministic history records
18
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.