CVEasy Weekly

This Week in Exposure

Week 42 · 2026-W42 · October 12 to October 18, 2026

The pattern this week is a release that does not fix the thing it was cut for. Ahsay shipped version 10.3.4.0 for two actively exploited zero-days in its backup console, and the vendor confirmed to Huntress that it closes neither one, so the only real move today is to pull the management interface off the internet.

The same gap runs through the rest of the list. A Kemp LoadMaster patch exists while 100,000-plus appliances still answer the vulnerable endpoint, and a SonicWall SMA 1000 fix shipped in July while INC Ransomware kept adding names to its leak site through August. Here is the week, ranked by what an attacker actually gets.

Top Exposures This Week

1. Two unpatched AhsayCBS bugs chain to a SYSTEM shell on backup consoles

CVE-2026-105133 and CVE-2026-105134 · AhsayCBS backup console · unauthenticated chain to SYSTEM · active exploitation since October 7, no complete patch

Huntress began recording unauthenticated calls into AhsayCBS consoles at 23:20:15 UTC on October 7, each one ending seconds later with the CBS service spawning child processes it should never run. CVE-2026-105133 is an authentication bypass in the checkSysPwd() function. It takes a random argument from the request as a nonce and mishandles it, so a crafted request passes the password check with no valid password. CVE-2026-105134 is an OS command injection in the Replication Receiver at /rps/api/json/UpdateReceivers.do, and its injection sink is the same random field the first bug was supposed to validate. Pass the bypass, pass the command, land on a shell. The Windows service runs as NT AUTHORITY\SYSTEM and the chain is unauthenticated end to end, so one HTTPS POST to the management port is a SYSTEM shell on the box that holds the keys to every backup it protects. Ahsay cut 10.3.4.0 on October 10 and confirmed to Huntress that it fixes neither CVE.

Risk read: Exploitation is confirmed in the wild by Huntress, three days after NVD published the pair on October 4, with JSP webshells written into the CBS application directory and XMRig miners dropped as edge.exe under a fake MicrosoftEdgeUpdateSvc service. The attack path is a single pre-auth request with no interaction, so first touch is counted in minutes. The scoring trap is that a scanner reads CVE-2026-105133 at CVSS 7.3 and files it for next cycle, because it cannot multiply a 7.3 bypass against the injection it unlocks. Exposure is top band on any AhsayCBS console with its management interface on the public internet, and the blast radius is as bad as it gets for a backup product. A SYSTEM shell on the console reaches into every customer environment the box replicates, which makes this an MSP-wide incident, not a single-host one.

Read how one random parameter owns the console →

2. One missing null byte roots any internet-facing Kemp LoadMaster

CVE-2026-8037 · Progress Kemp LoadMaster · CVSS 9.6, pre-auth root · CISA KEV, 792 confirmed exploit attempts

watchTowr Labs published a one-request exploit on June 29 for the load balancer that fronts DMZs, Exchange front ends, and login pages at the network edge, and CISA moved CVE-2026-8037 to KEV after 792 confirmed exploit attempts. The bug lives in a twenty-line helper called escape_quotes(). It allocates its output buffer with malloc(), which hands back raw heap memory, writes the escaped string in, and returns without a null terminator. A C string ends at the first zero byte, so sprintf keeps copying past the intended value into whatever neighbouring heap data sits next in the allocator arena. The /accessv2 endpoint parses its JSON body permissively, so the exploit sprays sixty decoy keys shaped to land in the freelist bin the escape buffer draws from, each carrying a semicolon, a shell command, and no closing quote. When sprintf reads into that neighbour, system() runs the attacker's command as root, with no authentication and a single request.

Risk read: Exploitation is top band on the KEV listing and watchTowr's public exploit, and Progress lists 100,000-plus LoadMaster deployments worldwide, so the target set is large. The attack path needs only that /accessv2 accepts a request, which it does wherever the API is enabled, so one unauthenticated POST reaches root with no user and no session. Exposure is top band on any LoadMaster with its management or API interface on the internet, and several bands lower on one reachable only from a management VLAN behind an ACL. Blast radius follows what the balancer fronts. Root on the box that terminates TLS and routes to your Exchange and login tiers is a position to read, redirect, and tamper with everything behind it.

Read how sixty decoy keys reach root →

3. INC Ransomware turned one SonicWall SMA 1000 bug into 885 victims

CVE-2026-15409 and CVE-2026-15410 · SonicWall SMA 1000 · unauthenticated wsproxy chain to root · patch shipped July 14, 885 names on the INC leak site

The SMA 1000 WorkPlace app exposes /wsproxy on port 443 as a WebSocket-to-TCP bridge for the Connect Agent client. In the affected firmware it trusts three caller-supplied fields, a User-Agent of SMA Connect Agent, a bmID parameter beginning with -3389, and the caller's own host and port values, with no session check and no destination allowlist. Set host to 127.0.0.1 and a pre-auth request from the internet reaches loopback services that were never supposed to leave the box, among them the CouchDB config store, the Erlang distribution port, and the Appliance Management Console ctrl-service on port 8188. That is CVE-2026-15409. The second half, CVE-2026-15410, lives in a remove_hotfix workflow on ctrl-service that takes a caller-supplied path, never canonicalizes it, and runs outside a chroot, so relative traversal escapes the hotfix directory and drives filesystem side effects that end in command execution as root. INC Ransomware added its latest SonicWall victim on August 2, weeks after the July 14 fix, and its leak site now runs 885 entries deep.

Risk read: Exploitation is top band and attributed. Rapid7 MDR documented the wsproxy behavior on disclosure day, and INC Ransomware is running the post-exploitation at scale. The shape is the one appliance VPN incidents always follow, a fast patch, a KEV deadline a chunk of the fleet misses, and the credentials resident on the box during the exposure window becoming the actual breach. Exposure is top band on any SMA 1000 that answered on port 443 while unpatched, even briefly, because the session and credential material it held is what INC monetizes. Blast radius is the remote-access edge itself and everything a stolen VPN session can reach inside it.

Read how a loopback field becomes root →

4. A poisoned Tensorlake npm release ran its worm under Bun to dodge EDR

Tensorlake npm 0.5.144 · Shai-Hulud ChainDrop variant · preinstall hook, Bun-launched credential worm · flagged by Socket 11 minutes after publish

At 01:12:07 UTC on October 8 the npm registry served tensorlake 0.5.144 to anyone running a bare npm install against the Tensorlake SDK, and Socket flagged it as malware eleven minutes later. The release manifest carried a preinstall hook that runs during npm install, before any require or test runner. The hook opens an outbound HTTPS connection, downloads the Bun JavaScript runtime, and uses it to execute a roughly 856 KB obfuscated payload, a ChainDrop variant of the Shai-Hulud credential-stealing worm. Launching under a freshly downloaded Bun binary is the whole trick. SOC detections for supply chain compromise watch Node process lineage and the npm child-process graph, and a payload that never runs under Node slips past them, because the host has no Bun allowlist, Bun was never installed, and no EDR rule had any baseline for anomalous Bun activity to compare against. Six tensorlake-native-* subpackages shipped on the same tag in the same automation run and landed in the resolved tree of anyone who installed.

Risk read: Exploitation is active. The malicious version was live on the public registry and pulled by ordinary installs before Socket caught it. The attack path needs no vulnerability in your code, only a developer or CI runner that ran npm install against the SDK during the window, and the payload executes at install time with that user's credentials in reach. Blast radius is every token and secret on the build host, npm and cloud credentials first, which a credential worm exists to harvest and reuse to spread. Exposure concentrates on CI pipelines and developer laptops that install from npm without a lockfile pin or an install-hook block, and drops to near zero where installs are pinned and preinstall scripts are disabled.

Read how the install hook brought its own runtime →

Threat Actor Spotlight

INC Ransomware is the named group behind this week's most measurable damage, with 885 organizations on its data leak site and the SonicWall SMA 1000 wsproxy chain as a documented entry vector, its latest victim posted on August 2 per the leak site itself. INC runs the appliance-VPN playbook that public incident reporting has described across several edge products. Exploit a pre-auth flaw on an internet-facing box, harvest the VPN sessions and credentials resident on it, and move inland from a trusted remote-access position rather than fighting the perimeter again. Hardening takeaway: patching the SMA 1000 does not end the incident for any appliance that was reachable while vulnerable. Rotate every credential and session secret the box held, hunt for the loopback-service abuse and path-traversal artifacts the chain leaves, and treat the exposure window, not the patch date, as the start of your incident timeline.

Signed CVEasy threat-intel IOC bundle current as of 2026-10-05. The desktop app verifies the ED25519 signature before import.

Three of this week's four items had a vendor release available, and the release did not make the fleet safe. One had no working patch at all. The number that tells you which box is your emergency is not the CVSS, it is your own exposure crossed with what attackers are doing today, which is the loop our CTEM platform runs with TRIS and the loop I want this letter to run for you every Monday. Start with the one that has no patch, AhsayCBS, where the fix is a firewall rule and the clock is already running.

Patch well,
Chris Boker
Founder, CVEasy AI