Detect Ahsay AhsayCBS Improper Authentication Exploitation (CVE-2026-105133) in Splunk
Detects exploitation attempts and successful improper-authentication bypass against Ahsay AhsayCBS backup servers (CVE-2026-105133, CWE-287). This KEV-listed flaw lets unauthenticated attackers bypass authentication to the AhsayCBS web management console (default TCP 443/80, admin paths under /cbs and /obs), gaining administrative access to backup infrastructure. Detection focuses on anomalous authentication successes without valid credential flows, access to privileged admin endpoints from external sources, and post-exploitation configuration changes to the backup server.
MITRE ATT&CK
SPL Detection Query
index=web (sourcetype="ms:iis:auto" OR sourcetype="iis" OR sourcetype="ahsay:cbs") (uri_path="*/cbs/admin*" OR uri_path="*/cbs/system*" OR uri_path="*/obs/console*" OR uri_path="*AuthProxy*")
| where status=200 OR status=302
| regex clientip!="^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)"
| stats count AS req_count values(uri_path) AS paths min(_time) AS first_seen max(_time) AS last_seen by clientip, dest
| where req_count > 5
| sort - req_countIdentifies external source IPs reaching AhsayCBS admin endpoints with successful responses, indicative of CVE-2026-105133 auth bypass.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Corporate admin access egressing through a public IP
- Sanctioned external penetration tests against the backup host
- Third-party backup-health monitoring tools
Other platforms for CVE-2026-105133
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Unauthenticated access attempt to AhsayCBS admin console
Expected signal: Web/IIS access log entry for GET /cbs/admin/ from the test source IP with a 200/302 status.
- Test 2 Repeated AuthProxy probing
Expected signal: Six web-log entries to the AuthProxy endpoint from a single source IP within a short window.
- Test 3 Login-then-admin access sequence
Expected signal: Two sequential web-log entries (login then console) from the same source within 5 minutes.
References (5)
- https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
- https://nvd.nist.gov/vuln/detail/CVE-2026-105133
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
Response Playbook
Triage
- Confirm the AhsayCBS server version against Ahsay's advisory (CVE-105133/105134 patch) and determine whether the patch is applied.
- Review the source IP(s) in the alert: establish whether they are known administrator egress addresses or unexpected external hosts, and enrich with geo/ASN/threat-intel.
- Examine the AhsayCBS access and authentication logs for the flagged time window to confirm whether admin-console access occurred without a preceding valid login/credential submission.
- Check for new or modified backup user accounts, replication targets, or scheduled backup set changes created around the time of the suspicious access.
Containment
- Block the offending source IP(s) at the perimeter firewall/WAF and restrict AhsayCBS console access to a management VLAN or VPN only.
- If compromise is confirmed, isolate the AhsayCBS host from the network and disable external exposure of the management ports (80/443) immediately.
- Apply the Ahsay vendor patch addressing CVE-2026-105133 and CVE-2026-105134, then rotate all AhsayCBS administrative and user credentials and API keys.
Evidence Collection
- Preserve AhsayCBS web/access logs, application logs, and the receiver/replication logs covering the suspected exploitation window.
- Capture a forensic image or snapshot of the AhsayCBS host and export the current user/account and backup-set configuration for comparison against a known-good baseline.
- Collect perimeter netflow/firewall logs for the source IP to scope lateral movement and data exfiltration from backup storage.
Escalation Criteria
- !Escalate to incident response if admin-console access is confirmed without a valid authentication flow or if unauthorized account/config changes are found.
- !Escalate to management and legal if backup archives were accessed, downloaded, or deleted, given the data-sensitivity and ransomware implications of backup compromise.
- !Escalate externally (CISA/vendor) if exploitation is confirmed, per BOD 26-04 KEV remediation obligations.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
AhsayCBS web access logs (IIS/Tomcat) under the install directory - >
AhsayCBS application and receiver logs showing session creation and config changes - >
Backup user/account configuration files and audit trail of account/backup-set modifications - >
Operating system authentication and process-creation logs on the AhsayCBS host
Tuning Guidance
Baseline the set of legitimate administrator source IPs and whitelist them, then lower the request-count threshold to catch low-and-slow exploitation. If AhsayCBS is only ever administered internally, invert the logic to alert on ANY external access to admin paths. Adjust the admin path list to match your deployment's actual /cbs and /obs context roots, and incorporate credential-flow correlation (login POST followed by admin GET without a valid session token) to reduce false positives from legitimate logins.
Hunting Queries
Hunt for external or anomalous access patterns to AhsayCBS privileged endpoints over time to identify slow or low-volume exploitation.
W3CIISLog | where csUriStem has_any ("/cbs/admin","/obs/console","AuthProxy") | where scStatus in (200,302) | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h) | sort by count_ descindex=web sourcetype="ms:iis:auto" (uri_path="*/cbs/admin*" OR uri_path="*/obs/console*" OR uri_path="*AuthProxy*") (status=200 OR status=302) | stats count by clientip, uri_path | sort - countAtomic Red Team Tests
Simulate an external request to an AhsayCBS administrative endpoint without authentication to generate detection telemetry.
Command
curl -sk -o /dev/null -w '%{http_code}\n' -A 'Mozilla/5.0' https://ahsay-lab.internal/cbs/admin/Cleanup
echo 'No cleanup required; read-only request'Expected Telemetry
Web/IIS access log entry for GET /cbs/admin/ from the test source IP with a 200/302 status.
Expected Detection
KQL/SPL admin-path rules flag the external access to /cbs/admin.
Issue multiple requests to the AhsayCBS AuthProxy endpoint to trigger the request-count threshold.
Command
for i in $(seq 1 6); do curl -sk -o /dev/null https://ahsay-lab.internal/cbs/AuthProxy?cmd=login; doneCleanup
echo 'No cleanup required'Expected Telemetry
Six web-log entries to the AuthProxy endpoint from a single source IP within a short window.
Expected Detection
Request-count aggregation rules (>5) fire for the AuthProxy path.
Simulate the auth-bypass sequence of a login request immediately followed by privileged console access.
Command
curl -sk -o /dev/null https://ahsay-lab.internal/cbs/login && curl -sk -o /dev/null https://ahsay-lab.internal/obs/consoleCleanup
echo 'No cleanup required'Expected Telemetry
Two sequential web-log entries (login then console) from the same source within 5 minutes.
Expected Detection
The Elastic EQL sequence rule correlates the login-to-console transition.