AhsayCBS Auth Bypass and Path Traversal Flaws Enable Remote Code Execution

Huntress reported in-the-wild exploitation of the AhsayCBS on-premises backup server on 8 August 2026. The threat actors chained an authentication bypass with a file write path traversal to achieve remote code execution. Horizon3.ai researchers later reverse-engineered the process, confirming that attackers could create administrator accounts and upload JSP webshells. These actions allowed command execution as SYSTEM and root users.

The risk

The first vulnerability, CVE-2026-105133, exists in the API components of the application. Horizon3.ai analysis showed that the authentication logic in the JSONApi base class relies on a boolean flag called FromServlet. When an attacker includes "FromServlet":"Y" in the request body, the system skips the credential validation function checkSysPwd. This allows unauthenticated access to the entire API surface without providing valid credentials.

With administrative API access secured, attackers exploit CVE-2026-105134, a path traversal flaw in the file write mechanism. The researchers demonstrated that the Replication Receiver service, which mirrors data to secondary servers, accepts unvalidated file paths. By manipulating the SystemHome parameter during receiver configuration, attackers can direct file writes to arbitrary locations within the application filesystem, facilitating webshell deployment.

Who is exposed

AhsayCBS is installed on both Linux and Windows servers, exposing organizations using either platform. The Horizon3.ai technical analysis focused on the Linux installer, which is distributed as a tarball containing a Java application and its own JRE. The application runs on the Tomcat framework, with the vulnerable components located in the webapps directory, specifically within the Replication Receiver and main console services.

Cost and compliance

The source material does not specify financial losses or compliance penalties. Huntress noted that the vulnerabilities were actively exploited in the wild. Ahsay released hotfixes on 12 October 2026 to address the issues. No further details regarding remediation costs or regulatory impacts were provided in the reporting from Horizon3.ai or Huntress.

What to watch

Security teams should verify the version of AhsayCBS running in their environment. Prioritize applying the hotfixes released by Ahsay on 12 October 2026. Monitor network traffic for unauthorized requests to the Replication Receiver endpoints, particularly those containing unusual file path parameters or the FromServlet flag.

Signals worth monitoring

Teams should review web server logs for requests to API endpoints that lack valid session tokens but contain the FromServlet parameter set to true. Look for sudden creation of new administrative user accounts, especially those generated via the AddSysUser endpoint without corresponding login events. Monitor file system changes in the application directory for unexpected JSP files or webshells. Check for outbound connections from the backup server to unknown external IPs, which may indicate command and control activity. Investigate any replication receiver configurations with modified SystemHome paths that point outside the expected data directories.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: AhsayCBS

• Apply the Ahsay hotfixes released on 12 October 2026 to your AhsayCBS installations immediately.
• Audit existing administrative accounts for any unauthorized additions or recent password changes.
• Scan the application filesystem for unexpected JSP files or webshells in the webapps directory.
• Review network logs for requests to the Replication Receiver endpoints containing the FromServlet flag.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the AhsayCBS vulnerabilities?

The vulnerabilities are identified as CVE-2026-105133, an authentication bypass, and CVE-2026-105134, a path traversal leading to remote code execution.

When were the fixes released?

Ahsay released hotfixes for these issues on 12 October 2026.

Can unauthenticated users exploit these flaws?

Yes, the authentication bypass allows unauthenticated users to access the API and create administrator accounts, which can then be used to exploit the path traversal vulnerability.