SB20261015149 - Multiple vulnerabilities in AhsayCBS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2026-105133) Exploited

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in the checkSysPwd function in com/ahsay/obs/api/ApiStructsAction.java when handling API authentication requests. A remote attacker can submit a random token in place of valid credentials to bypass authentication.

The vulnerability has been exploited in conjunction with CVE-2026-105134 since at least October 4, 2026.

2) Improper Authentication (CVE-ID: CVE-2026-105134) Exploited

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper authentication in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do when handling receiver configuration requests. A remote attacker can configure a malicious replication receiver and place a JSP webshell in the application directory to execute arbitrary code.

Observed exploitation chained this vulnerability with CVE-2026-105133. On the targeted Windows hosts, code ran as NT AUTHORITY/SYSTEM.

Remediation

Install update from vendor's website.

References

• https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
• https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update