Active Exploitation of AhsayCBS Vulnerabilities Confirmed by Huntress
Cybersecurity firm Huntress has issued a warning that two unpatched vulnerabilities in the AhsayCBS backup solution are being actively exploited in the wild for remote code execution. The flaws, tracked as CVE-2026-105133 and CVE-2026-105134, affect all versions of AhsayCBS up to and including the latest release, version 10.3.4. These vulnerabilities were first disclosed on October 4, when NIST alerted the public that exploit code had been released and that the defects allowed attackers to bypass authentication and inject operating system commands.
Attack Chain and Impact Observed in the Wild
According to Huntress, threat actors are chaining the two vulnerabilities to achieve unauthenticated remote code execution on exposed systems. As of October 8, at least five organizations had been targeted in these attacks. Once inside, attackers deploy webshells to maintain access and conduct reconnaissance. Huntress observed that CVE-2026-105134 specifically can be exploited via the Replication Receiver component’s API, where an authentication bypass allows a random token to substitute valid credentials.
After gaining initial access, attackers configure a malicious receiver and drop a Java Server Page (JSP) webshell into the application directory served by the CBS application. This enables them to execute arbitrary code with System privileges on the compromised host.
Post-Exploitation Activities and Persistence Mechanisms
Following initial compromise, the attackers conducted system reconnaissance and deployed cryptocurrency mining software. Specifically, they dropped XMRig cryptominers disguised as Microsoft Edge to avoid detection. To maintain persistence, they created a Windows service masquerading as a legitimate Microsoft Edge Update service. This service executes a modified copy of the NSSM (Non-Sucking Service Manager) utility, renamed to msedge.exe, which runs with System privileges.
Huntress explained that NSSM is commonly used to ensure applications restart after crashes or reboots, and in this case, threat actors likely used it to maintain persistence for the malicious edge.exe binary while disguising it as a legitimate system component.
In one observed attack, the threat actors deployed WinRing0x64.sys, a legitimate but vulnerable kernel driver. This allowed the cryptocurrency miner to operate with kernel-level access, significantly increasing its stealth and resistance to removal.
Additionally, attackers planted an AI-assisted PowerShell script designed to monitor the Windows Task Manager. If the Task Manager remains open for an extended period, the script terminates it to prevent users from detecting suspicious processes or resource usage.
Recommendations for Defense and Mitigation
Huntress advises organizations using AhsayCBS to immediately restrict access to the management interface. Since the exploit targets the externally accessible web application service, access should be limited to trusted IP addresses only or require a virtual private network (VPN) connection.
Until an official patch is released by Ahsay Systems, organizations should investigate for signs of compromise, including unusual webshells, unexpected services, and abnormal processor or network activity linked to cryptocurrency mining. Monitoring for the presence of JSP webshells in application directories and unauthorized Windows services is critical.
The firm emphasized that defense-in-depth principles, including network segmentation, least privilege access, and robust endpoint detection, remain essential even as threat actors leverage automation and AI to accelerate exploitation timelines.
Source: SecurityWeek