AhsayCBS Authentication and Command Injection Flaws

What happened

Ahsay has released updates for AhsayCBS addressing authentication and command injection vulnerabilities. Think of authentication as a front desk checking someone's credentials, and command handling as the instructions passed to staff behind that desk. These flaws concern whether the credential check works properly and whether supplied information can become an operating system instruction.

The vendor advisory identifies affected releases and their fixes, while NVD describes the weaknesses under CVE-2026-105133 and CVE-2026-105134. For the corresponding release branches, affected versions are earlier than 9.15.2.70 and earlier than 10.3.4.45. The listed fixed releases are 9.15.2.70 and later, and 10.3.4.45 and later, respectively. NVD also notes that an initial patch did not fully correct the vulnerabilities, making the exact installed release important.

Both vulnerabilities are known to be exploited: CISA added CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a listed due date of 2026-10-17. NVD published both entries on 2026-10-04. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-21.

Technical details

CVE-2026-105133 concerns improper authentication, classified as CWE-287, Improper Authentication. Authentication is the process used to establish whether a caller has valid credentials. In the AhsayCBS API, manipulating an argument named random affects a password-checking function and causes authentication to behave incorrectly. NVD describes the attack as remotely possible and reports that an exploit is public. Its description does not establish every access requirement, so administrators should avoid assuming that a particular login or network arrangement prevents exploitation.

CVE-2026-105134 concerns command injection in the AhsayCBS Replication Receiver. Its classifications are CWE-77, Improper Neutralization of Special Elements used in a Command ('Command Injection'), and CWE-78, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). In plain language, information supplied to an application can influence instructions sent to the operating system. NVD identifies manipulation of an argument named random as the trigger and says the attack can be launched remotely. A public exploit is also reported for this vulnerability.

NVD lists a CVSS 4.0 score of 6.9, rated MEDIUM, for CVE-2026-105133, and a CVSS 4.0 score of 10.0, rated CRITICAL, for CVE-2026-105134. CVSS, the Common Vulnerability Scoring System, summarizes technical severity. It does not tell an administrator whether a particular installation has already been attacked. The CISA KEV listings provide separate evidence that exploitation is known to have occurred.

The descriptions identify different failures: an authentication problem in the API and operating system command injection in the Replication Receiver. They do not establish that attackers must combine the vulnerabilities or use them in a particular order. Likewise, the shared argument name does not establish a shared implementation defect. The supported conclusion is that both issues require attention and have the same listed fixed releases.

Weakness types: Command injection

Who is affected

Everyday users

For everyday users, the relevant question is whether an organization or service they rely on runs an affected AhsayCBS release. Correcting these server vulnerabilities generally requires action by whoever operates that installation. If another organization manages the service, ask whether its AhsayCBS deployment has reached a listed fixed release for its branch.

Known exploitation does not mean every AhsayCBS installation has been compromised. It does mean these vulnerabilities have been used in attacks. CISA lists known ransomware use as Unknown for both entries; that designation neither confirms ransomware involvement nor establishes that it has never occurred.

Developers

Developers responsible for AhsayCBS integrations should distinguish the authentication defect from the command injection defect. The API issue concerns a credential-checking function, while the Replication Receiver issue concerns how supplied information can influence operating system commands. The advisory does not establish that an application's own integration code is vulnerable, but an integration may depend on an affected AhsayCBS installation.

The practical task is to identify those dependencies and coordinate with the installation's owner on the update. Because NVD says an initial patch was incomplete, a statement that the server was previously patched is insufficient by itself. Confirm the installed version against the vendor's listed fixed release for the relevant branch.

Server and IT admins

Server and IT administrators should prioritize finding affected AhsayCBS deployments and determining their release branches. Use the corresponding threshold: 9.15.2.70 for its branch and 10.3.4.45 for its branch. Treating these as interchangeable version targets could produce an incorrect assessment of whether a deployment is fixed.

Both KEV listings warrant attention, including the authentication vulnerability with the MEDIUM severity rating. A lower CVSS score does not erase evidence of exploitation. Also distinguish remediation from incident assessment: confirming a fixed version establishes the update status, but it does not establish whether exploitation occurred before the update.

What to do now

1. Identify the AhsayCBS installations you operate or depend on, and record each installation's exact version and release branch.
2. Compare each version with the vendor advisory. Releases earlier than 9.15.2.70 or earlier than 10.3.4.45 are affected within their respective branches.
3. Prioritize the update using both vulnerabilities' CISA KEV status. Both were added on 2026-10-14, and both have a listed due date of 2026-10-17.
4. Follow the update steps in the vendor's advisory to reach 9.15.2.70 and later or 10.3.4.45 and later, as appropriate for the installed branch.
5. Check the installed version after the update. Because an initial patch was incomplete, verify the actual release instead of relying only on a previous maintenance record.
6. Confirm that the AhsayCBS functions your organization uses still work after the update, including API integrations or Replication Receiver operations where applicable.

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to affected AhsayCBS services and reducing their internet exposure. Treat access restrictions as an interim measure while arranging the update.

How to confirm the fix

• Confirm that each installation reports 9.15.2.70 and later or 10.3.4.45 and later for its corresponding release branch.
• Check that the vendor advisory identifies the installed release as addressing both CVE-2026-105133 and CVE-2026-105134.
• Review the update result and confirm normal operation of the AhsayCBS functions and integrations in use. Successful operation alone does not prove that the security fix is installed.
• Keep version verification separate from any assessment of earlier compromise. A fixed release does not demonstrate that the installation was never exploited.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-105133 (added October 14, 2026), CVE-2026-105134 (added October 14, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 4 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Ahsay advisory: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
• NVD: CVE-2026-105133
• NVD: CVE-2026-105134
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 21, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.