AhsayCBS (Product): news timeline & CVEs

Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers

Attackers are exploiting two AhsayCBS zero-days for unauthenticated SYSTEM access on exposed backup servers.

Field Effect reported that attackers began exploiting two Ahsay Cloud Backup Server zero-days on October 7, 2026. CVE-2026-105133 is improper authentication in checkSysPwd (CVSS 5.5), and CVE-2026-105134 is OS command injection in the Replication Receiver (CVSS 9.3). Chained, they let unauthenticated attackers configure a malicious receiver, deploy a JSP web shell, and execute as NT AUTHORITY\SYSTEM. Observed intrusions installed XMRig miners disguised as Microsoft Edge, a fake Edge update service, and PowerShell concealment scripts; five organizations were identified on the first reporting day. Versions through 10.3.4 were vulnerable.

GBHackers07:27 UTC · 15h agoExploit / PoC in the wild 5 sources CVE-2026-105133 CVE-2026-105134

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Attackers exploit unpatched AhsayCBS flaws to plant JSP webshells and XMRig miners at five organizations.

Huntress observed attacks on 7 October 2026 against at least five organizations using AhsayCBS, backup software common among MSPs. Attackers chained CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134, an OS command injection, then deployed JSP webshells and XMRig disguised as edge.exe. The miner persists through a service named MicrosoftEdgeUpdateSvc and a PowerShell script hides it when Task Manager is open; one case also dropped the vulnerable WinRing0x64.sys driver. Ahsay said both issues were fixed in 10.3.2, but Huntress found 10.3.4, the latest version, still affected.

BleepingComputerupdated 07:27 UTC · 15h agofirst Oct 9, 17:17 UTC · 1d agoExploit / PoC in the wild 5 sources CVE-2026-105133 CVE-2026-105134

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge.

Huntress says unidentified attackers began exploiting two AhsayCBS backup flaws on October 7, 2026, affecting about five organizations. CVE-2026-105133 (CVSS 5.5) is an authentication weakness in checkSysPwd(), and CVE-2026-105134 (CVSS 9.3) is command injection in the Replication Receiver; chaining them allows remote code execution. Operators deployed web shells and XMRig miners named edge.exe, plus a PowerShell script that stops mining when Task Manager stays open. NVD says 10.3.4 fixes the issues, but Huntress reports that version is still vulnerable; one case used certutil to fetch WinRing0x64.sys.

The Hacker Newsupdated 07:27 UTC · 15h agofirst Oct 9, 12:47 UTC · 1d agoExploit / PoC in the wild 5 sources CVE-2026-105133 CVE-2026-105134

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Huntress says attackers are exploiting unpatched AhsayCBS flaws for unauthenticated RCE, webshells, and cryptominers.

Huntress says attackers are chaining two unpatched AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, for unauthenticated remote code execution. NIST disclosed them on October 4 with public exploit code; versions through 10.3.4 remain affected. By October 8 at least five organizations were hit, with JSP webshells, XMRig miners disguised as Microsoft Edge, PowerShell monitoring, and persistence via a fake Edge Update service using NSSM. One case also loaded the vulnerable WinRing0x64.sys driver. Huntress advises restricting the management interface to trusted IPs or a VPN until a patch exists.

SecurityWeekupdated 07:27 UTC · 15h agofirst Oct 9, 10:23 UTC · 1d agoExploit / PoC in the wild 5 sources CVE-2026-105133 CVE-2026-105134

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Huntress saw attackers chain two AhsayCBS flaws for SYSTEM RCE, webshells, and XMRig mining.

Huntress observed threat actors chaining two AhsayCBS flaws from 7 October 2026 to gain unauthenticated remote code execution as NT AUTHORITY\SYSTEM. Medium CVE-2026-105133 bypasses authentication in checkSysPwd, and critical CVE-2026-105134 in the Replication Receiver UpdateReceivers.do API enables code execution. Actors dropped JSP webshells and an XMRig miner masquerading as Microsoft Edge, persisted it with a fake MicrosoftEdgeUpdateSvc service and modified NSSM, and in one case loaded vulnerable WinRing0x64.sys. Huntress later found AhsayCBS 10.3.4 is affected and advises restricting the management interface until a patch is available.

Huntressupdated 07:27 UTC · 15h agofirst Oct 8, 20:00 UTC · 2d agoExploit / PoC in the wild 5 sources CVE-2026-105133 CVE-2026-105134

AhsayCBS

Timeline5 articles

Related CVEsby mentions

Appears with

Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer