Short answer: Vulnerabilities in AhsayCBS were exploited to deploy a Python backdoor. Users of AhsayCBS should apply the latest hotfixes to secure their systems.
TL;DR
- Two vulnerabilities (CVE-2026-105133, CVE-2026-105134) were exploited.
- A Python backdoor was deployed, evading sandboxes.
- XMRig miners were installed on affected systems.
- Hotfixes are available to patch the vulnerabilities.
What is CVE-2026-105133?
This incident involved attackers exploiting two vulnerabilities in AhsayCBS to deploy a Python backdoor. The backdoor is designed to run only on the host it's staged on, making it hard to detect and analyze. It also installed XMRig miners to mine cryptocurrency.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Malware
- Harmful software made to spy, steal or damage.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 10 Nov 2026 |
| CVE | CVE-2026-105133 |
| CVSS | 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-287 (improper authentication) |
| CISA KEV | Yes, added 2026-10-14; federal due date 2026-10-17 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | www.ahsay.com |
| CVE | CVE-2026-105134 |
| CVSS | 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-77 (see NVD), CWE-78 (OS command injection) |
| CISA KEV | Yes, added 2026-10-14; federal due date 2026-10-17 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | www.ahsay.com |
| Affected product | Ahsay AhsayCBS |
| Published in NVD | 2026-10-04 (CVE-2026-105133) |
| Published in NVD | 2026-10-04 (CVE-2026-105134) |
How it works
Attackers used two flaws in AhsayCBS, first to bypass login and run commands, then deployed web shells, miners, and a Python backdoor. This allowed them to control the system from a remote location.
- Attacker reaches the Ahsay AhsayCBS over the internet / network
- No login or account is needed
- Sends crafted input that triggers the improper authentication flaw
- Impact: limited (see the facts table)
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-10-04 | CVE-2026-105133 published in NVD | NVD |
| 2026-10-04 | CVE-2026-105134 published in NVD | NVD |
| 2026-10-14 | CVE-2026-105133 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-10-14 | CVE-2026-105134 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-10-17 | US federal agencies must patch by this date | CISA KEV |
| 2026-11-10 | Reported by The Hacker News | The Hacker News |
| 2026-11-10 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Ahsay AhsayCBS to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-105133 and upgrade to the fixed release it lists.
- CVE-2026-105133 is in CISA KEV: treat it as actively exploited and patch first.
- Read the vendor advisory for CVE-2026-105134 and upgrade to the fixed release it lists.
- CVE-2026-105134 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should watch for odd logins, unexpected system commands, and unusual files.
What is confirmed
- CVE-2026-105133 is a real NVD record scored 6.9 MEDIUM
- CISA lists CVE-2026-105133 as exploited in the wild
- CVE-2026-105134 is a real NVD record scored 10.0 CRITICAL
- CISA lists CVE-2026-105134 as exploited in the wild
- Reported by The Hacker News
- Reported by www.ahsay.com
Why it matters
This attack shows how critical it is to keep software updated. Cybersecurity is essential for protecting data and systems, especially in India where backup infrastructure is crucial.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
Related Skillmate posts
Sources
- Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor (The Hacker News)
- Vendor advisory CVE-2026-105133 (www.ahsay.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.