CVE-2026-105134 Elastic Security · Elastic

Detect Ahsay AhsayCBS Command Injection (CVE-2026-105134) in Elastic Security

Detects exploitation of CVE-2026-105134, a command injection vulnerability in Ahsay AhsayCBS (Cloud Backup Suite) backup server. The flaw (CWE-77/CWE-78) allows an attacker to inject OS commands through unsanitized input processed by AhsayCBS web/management components, resulting in arbitrary command execution in the context of the AhsayCBS service account. The vulnerability is listed in CISA KEV (known exploited) and is subject to CISA BOD 26-04 remediation prioritization. This detection surfaces anomalous child-process spawning from AhsayCBS/Java processes, suspicious web-access patterns to AhsayCBS management endpoints, and shell/command-interpreter execution originating from the backup server tier.

MITRE ATT&CK

Tactic
Initial Access Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
process where event.type == "start" and
  (process.parent.name : ("java.exe","javaw.exe","AhsayCBS.exe","tomcat.exe","catalina.exe","httpd","java") or
   process.parent.executable : ("*AhsayCBS*","*Ahsay*")) and
  process.name : ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","certutil.exe","bitsadmin.exe","curl","wget","whoami","net.exe","nltest.exe","wscript.exe","cscript.exe")
critical severity high confidence

Elastic EQL rule matching shell/recon/download child processes under AhsayCBS Java/web parents, indicating CVE-2026-105134 exploitation.

Data Sources

Elastic DefendWindows Process EventsLinux Process Events

Required Tables

logs-endpoint.events.process-*

False Positives & Tuning

  • Administrator-configured AhsayCBS backup command scripts.
  • Monitoring agents that fork shells beneath the Java runtime.
  • Planned maintenance tasks run on the backup server.

Other platforms for CVE-2026-105134

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 AhsayCBS-style command injection via Java child shell (Windows)

    Expected signal: Process creation event with ParentImage containing java and child cmd.exe executing whoami/hostname/net user.

  2. Test 2 Injected download via certutil from backup-server shell (Windows)

    Expected signal: Process creation of certutil.exe with -urlcache download arguments under a cmd.exe child.

  3. Test 3 AhsayCBS command injection via shell on Linux

    Expected signal: Linux process execution event showing java parent spawning /bin/sh running id/uname/whoami.

Last updated: 2026-10-15 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected host runs Ahsay AhsayCBS and determine the running version; compare against the Ahsay patch advisory for CVE-2026-105133/105134 to establish exposure.
  2. Review the parent/child process chain: confirm the shell or utility was spawned directly by the AhsayCBS Java/Tomcat process rather than by an administrator session or legitimate backup hook.
  3. Pull the full command line of the child process and any downstream processes; look for encoded PowerShell, certutil/bitsadmin downloads, reconnaissance (whoami, net, nltest), or reverse-shell indicators.
  4. Correlate the process event time with AhsayCBS web/management access logs to identify the source IP and request that triggered the injection.

Containment

  1. Isolate the AhsayCBS host from the network (EDR network containment or VLAN quarantine) to halt command execution and lateral movement.
  2. Block the identified attacker source IP(s) at the perimeter and disable external exposure of the AhsayCBS management interface until patched.
  3. Suspend or reset the AhsayCBS service account credentials and any credentials accessible from the backup server.

Evidence Collection

  1. Capture full process creation telemetry (parent/child, command lines, hashes) and the AhsayCBS application/web access logs covering the exploitation window.
  2. Preserve a forensic disk and memory image of the AhsayCBS host before remediation, including the AhsayCBS install directory, logs, and any dropped files in temp/web directories.

Escalation Criteria

  • !Escalate to incident response immediately if the spawned process executed downloads, created accounts, modified backup data, or established outbound C2 connections.
  • !Escalate to the data-protection/crisis team if evidence shows access to or tampering with backup repositories, given the sensitivity of backup data on AhsayCBS.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >AhsayCBS web/management access logs showing the malicious request parameters.
  • >Process creation events linking the Java/Tomcat parent to shell/recon child processes.
  • >Newly created or modified files in the AhsayCBS install and web/temp directories (potential web shells or dropped tools).

Tuning Guidance

Baseline legitimate AhsayCBS administrator backup command hooks (pre/post-backup scripts) and exclude their specific command-line patterns and invoking accounts. Restrict the detection to hosts confirmed to run AhsayCBS to reduce noise. If an EDR or management agent legitimately spawns shells under the Java runtime, exclude by signed image path rather than by process name alone.

Hunting Queries

Hunts for AhsayCBS-parented processes executing encoded PowerShell, download utilities, or reconnaissance commands indicative of post-exploitation.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","javaw.exe") and InitiatingProcessFolderPath has "Ahsay" | where ProcessCommandLine has_any ("Invoke-","-enc","certutil","bitsadmin","whoami","nltest","net user") | project Timestamp, DeviceName, FileName, ProcessCommandLine
Hunting — SPL
spl 
index=endpoint sourcetype=Sysmon EventCode=1 (ParentImage="*java*" OR ParentImage="*Ahsay*") (CommandLine="*-enc*" OR CommandLine="*certutil*" OR CommandLine="*bitsadmin*" OR CommandLine="*whoami*" OR CommandLine="*net user*") | table _time host ParentImage Image CommandLine

Atomic Red Team Tests

Test 1 AhsayCBS-style command injection via Java child shell (Windows)
windows

Simulates command injection by having a Java process spawn cmd.exe to run reconnaissance, mimicking CVE-2026-105134 exploitation telemetry.

Command

powershell 
java -version 2>&1 | Out-Null; Start-Process -FilePath "$env:ComSpec" -ArgumentList '/c whoami & hostname & net user' -NoNewWindow -Wait

Cleanup

powershell 
Remove-Variable -Name ComSpec -ErrorAction SilentlyContinue; echo 'no persistent artifacts created'

Expected Telemetry

Process creation event with ParentImage containing java and child cmd.exe executing whoami/hostname/net user.

Expected Detection

KQL/SPL/EDL rules fire on java.exe spawning cmd.exe with recon command line.

Test 2 Injected download via certutil from backup-server shell (Windows)
windows

Emulates a post-injection payload download using certutil launched from a shell under a Java-style parent.

Command

powershell 
& "$env:ComSpec" /c "certutil.exe -urlcache -split -f http://127.0.0.1/test.txt %TEMP%\ahsay_test.txt"

Cleanup

powershell 
Remove-Item -Path "$env:TEMP\ahsay_test.txt" -ErrorAction SilentlyContinue

Expected Telemetry

Process creation of certutil.exe with -urlcache download arguments under a cmd.exe child.

Expected Detection

Detection fires on certutil download utility invoked in the AhsayCBS process chain.

Test 3 AhsayCBS command injection via shell on Linux
linux

Simulates command injection on a Linux AhsayCBS host where the Java process spawns a shell running reconnaissance, matching CVE-2026-105134 behavior.

Command

bash 
java -version 2>/dev/null; /bin/sh -c 'id; uname -a; whoami > /tmp/ahsay_cve_test.txt'

Cleanup

bash 
rm -f /tmp/ahsay_cve_test.txt

Expected Telemetry

Linux process execution event showing java parent spawning /bin/sh running id/uname/whoami.

Expected Detection

Elastic EQL / Chronicle rule fires on Java parent spawning sh with recon commands.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0002 Execution

Related Techniques

T1190 Exploit Public-Facing Application T1059 Command and Scripting Interpreter T1505.003 Web Shell

Same Tactic: Initial Access

Popular Detections