Active Exploitation of AhsayCBS Vulnerabilities
Threat actors are actively exploiting two unpatched security flaws in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners, according to findings from Huntress, a managed detection and response provider. The attacks were first observed on October 7, 2026, and have targeted at least five organizations using the platform, which is commonly deployed by managed service providers and system integrators.
Details of the Exploited Vulnerabilities
The two vulnerabilities being chained in these attacks are tracked as CVE-2026-105133 and CVE-2026-105134. CVE-2026-105133 is a critical authentication bypass flaw for which a public exploit exists, allowing attackers to gain initial access without valid credentials. CVE-2026-105134 is a medium-severity OS command injection vulnerability that enables arbitrary code execution once access is obtained.
Although Ahsay released fixes for both issues in version 10.3.2, Huntress researchers confirmed that the vulnerabilities also affect AhsayCBS 10.3.4, which is currently the latest available version. In an update issued on October 9, 2026, Huntress stated: "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities."
Attack Chain and Post-Exploitation Activities
In the observed intrusions, attackers first exploited CVE-2026-105133 to bypass authentication mechanisms, then leveraged CVE-2026-105134 to achieve remote code execution. Following initial compromise, Huntress observed the threat actors conducting reconnaissance, deploying Java Server Page (JSP) webshells for persistent access, and downloading a cryptocurrency miner.
The miner identified in the attacks is XMRig, which was disguised as a legitimate file named edge.exe. To maintain persistence, the attacker installed a service called ‘MicrosoftEdgeUpdateSvc’ that executes msedge.exe — a modified version of the Non-Sucking Service Manager (NSSM) utility, a tool commonly used to run applications as Windows services.
Evasive Tactics Using PowerShell Script
Huntress analyzed a PowerShell script named Taskgmr.ps1 that appears to be AI-assisted and is designed to conceal mining activity. The script monitors for the opening of Windows Task Manager and automatically stops the mining service when detected. It restarts the miner once Task Manager is closed. Additionally, the script terminates Task Manager if it remains open for more than one hour or if it is still active at 6 p.m. local time, reducing the likelihood of user detection.
Additional Privilege Escalation Attempt
In at least one observed case, the attacker deployed the vulnerable WinRing0x64.sys driver. This driver is known to allow direct hardware access and was likely used in an attempt to unlock additional CPU or GPU resources to enhance the efficiency of the cryptocurrency mining operation.
Response and Mitigation Guidance
As of the publication date, AhsayCBS has not responded to BleepingComputer’s request for comment regarding a timeline for fixing the flaws in the latest version. Until an official patch is released that addresses the vulnerabilities in version 10.3.4, Huntress recommends that administrators restrict access to the AhsayCBS management interface to trusted IP addresses only and actively monitor for indicators of compromise.
If a breach is confirmed, Huntress advises performing a full system restore from a known-safe backup, as the attacker may have installed additional backdoors to ensure long-term persistence. To aid detection efforts, Huntress has published indicators of compromise (IoCs) and four Sigma rules tailored to detect this specific attack pattern.
Source: BleepingComputer