AhsayCBS Under Attack: From a Java Boolean to SYSTEM-Level RCE

Two vulnerabilities in AhsayCBS enable RCE as SYSTEM/root via an attacker-controlled JSON flag. Active exploitation began October 7 with cryptominer deployment.

On October 7, 2026 at 23:20:15 UTC, Huntress sensors detected the first active exploitation against AhsayCBS, an on-premises backup server used by Managed Service Providers to protect enterprise data. The attack chained two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in a sequence that starts with a trivial authentication bypass — a JSON flag called FromServlet — and ends with remote code execution as LocalSystem on Windows, root on Linux. Within days, five organizations were compromised, with webshells, XMRig cryptominer disguised as Microsoft Edge, and AI-assisted PowerShell scripts on board.

Key Takeaways

A boolean FromServlet flag in API request JSON bodies completely bypasses AhsayCBS credential checks, allowing creation of arbitrary administrators.
A path traversal in the Replication Receiver service permits writing JSP files to the Tomcat web root, turning authenticated access into remote execution with maximum privileges.
Huntress confirmed in-the-wild exploitation from October 7, 2026, with five targeted organizations and post-exploitation activity including cryptominers and persistence scripts.
Previous patches (v9.15.2.59 and v10.3.4.0) were insufficient; Ahsay released corrective hotfixes on October 12, 2026.

The Mechanism: When an "Internal Trust" Flag Becomes a Backdoor

Horizon3.ai's technical analysis, based on reverse engineering AhsayCBS's Java/Struts code, isolated the root design flaw behind the bypass. In the JSONApi.execute() method, authentication logic rests on three boolean variables: b, equals2, and equals. The latter is read directly from the request JSON body as the value of the FromServlet field. If equals is true, the checkSysPwd() method — the actual credential check — is never invoked.

As Horizon3.ai documents: "a request that simply includes FromServlet':'Y sets equals to true, and the credential check is never reached." The attacker needs no stolen passwords, sessions, or tokens: simply adding a JSON field to a normal HTTP request causes the server to treat it as a trusted internal call.

Once inside, the AddSysUser endpoint allows creation of a full administrator. Decompiled code shows doAction extracts LoginName, Password, and Role from the JSON and constructs the new user without verifying who is actually calling. No session check, no prior privilege required.

From Arbitrary Admin to SYSTEM Webshell: The Traversal That Bypasses the Denylist

With administrative credentials in hand, the attacker configures a Replication Receiver with a manipulated SystemHome. Here CVE-2026-105134 comes into play: the FileService allows file writes with a user-controlled path, but the protection proves insufficient.

Horizon3.ai mapped the flawed logic in detail. The FileList.a() denylist blocks only two characters — % and : — leaving the ../ pattern intact. The getReplicatedPath() method concatenates the UserHome value without reapplying the com.ahsay.c filter used when the receiver is created. The result: a UserHome like ../../webapps/rps resolves to C:\AhsayCBS\webapps\rps on Windows, allowing a JSP webshell to be written directly into the Tomcat root.

The AhsayCBS service runs as LocalSystem on Windows and as root on Linux. Horizon3.ai confirms: "On a Windows receiver, the AhsayCBS service runs as LocalSystem, so the webshell executes as SYSTEM. On Linux it runs as root." The compromise is not limited access: it is total control of the machine and every backup it contains.

In-the-Wild Exploitation: Five Victims, Miners, and AI-Assisted Scripts

Huntress observed the attack in the field before Ahsay released effective patches. "Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts," the threat detection company reports. The number of organizations targeted with this specific chain is five.

"threat actors are conducting reconnaissance, dropping webshells, planting XMRig cryptominers masquerading as Microsoft Edge, and more. They also dropped what appears to be an AI-assisted PowerShell script" — Huntress report

The post-exploitation payload is heterogeneous and indicates active operators, not just opportunists. Beyond the webshell for persistent access, there is XMRig disguised as a Microsoft Edge executable — a classic masquerading trick — and a PowerShell script that, according to Huntress, shows characteristics of AI-assisted generation, with functionality to monitor and terminate Task Manager to hide miner activity.

What to Do Now

Verify the installed version: releases v10.3.4.45 (for v10) and v9.15.2.70 (for v7-v9), published by Ahsay on October 12, 2026, are the first to effectively mitigate the auth bypass. Previous patches v9.15.2.59 and v10.3.4.0 were insufficient, as acknowledged by the vendor.
Plan a server reboot: the hotfix requires a restart to take effect, with a maintenance window that temporarily exposes the system to known risk.
Inspect logs for API requests with the FromServlet field present before authentication, and check for replication receivers with anomalous SystemHome or UserHome values.
Look for known indicators of compromise: unauthorized JSP files in webapps/rps, processes masquerading as Microsoft Edge running from non-standard paths, PowerShell scripts with process-termination behaviors.

Context: Why a Backup Server Is a Strategic Target

AhsayCBS is not a niche product. It is an on-premises backup server designed for MSPs, with support for Microsoft 365, Google Workspace, virtual machines, and databases. Its function — storing copies of critical data — makes it inherently sensitive: a compromised server exposes not a single tenant, but the entire client portfolio of the provider. The fact that compromise occurs as SYSTEM/root means the attacker can not only exfiltrate backups, but potentially destroy them or inoculate them with ransomware, defeating the very purpose of the product.

The picture that emerges from Horizon3.ai's analysis is one of security reduced to a single boolean. The FromServlet flag was clearly intended to distinguish internal calls — servlet-to-servlet — from external ones. But in a Struts framework exposed over HTTP, any client can set that field. The trust boundary violation is total: the server trusts an unauthenticated assertion, sent by the attacker, to skip authentication. This is the type of flaw found in legacy codebases grown over years without architectural security review.

On attribution, the dossier offers no elements: no infrastructure overlaps link the operators to a known threat actor group at this time. The AI-assisted nature of the PowerShell script is a Huntress observation, not proof of large-scale automated orchestration. The official CVSS is not available in the sources consulted.

The fact remains that a product used for the digital resilience of thousands of organizations proved vulnerable to a conceptually elementary attack: a JSON field set to Y. The complexity of the post-exploitation — disguised miners, AI-assisted scripts, webshells — shows, however, that sophisticated actors are actively monitoring this class of target, ready to exploit the smallest flaw in the backup supply chain.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter