Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Huntress says attackers are exploiting unpatched AhsayCBS flaws for unauthenticated RCE, webshells, and cryptominers.
Huntress says attackers are chaining two unpatched AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, for unauthenticated remote code execution. NIST disclosed them on October 4 with public exploit code; versions through 10.3.4 remain affected. By October 8 at least five organizations were hit, with JSP webshells, XMRig miners disguised as Microsoft Edge, PowerShell monitoring, and persistence via a fake Edge Update service using NSSM. One case also loaded the vulnerable WinRing0x64.sys driver. Huntress advises restricting the management interface to trusted IPs or a VPN until a patch exists.
- CVE-2026-105133 and CVE-2026-105134 allow unauthenticated command injection on AhsayCBS.
- Builds through 10.3.4 are vulnerable and no patch is available yet.
- Huntress saw at least five organizations compromised by October 8.
- Intruders dropped JSP webshells, XMRig miners, and a fake Edge service.
- Limit management-console access to trusted addresses or a VPN.
Vulnerabilities mentionedAll →
- CVE-2026-1051349.32%Unauthenticated OS Command Injection in AhsayCBSpublished · AhsayCBS PoC +1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-105134 |
Full article477 words · extracted from securityweek.com · click to collapse
Hackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.
A centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.
Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.
They were disclosed on October 4, when NIST warned that exploit code targeting them had been released, and that all AhsayCBS versions up to 10.3.2 were affected.
On Thursday, Huntress warned that attackers have exploited the two flaws in the wild and that the latest AhsayCBS version, 10.3.4, is also affected.
“Until a patch is available, we recommend restricting access to the management interface and investigating for signs of compromise,” Huntress says.
Advertisement. Scroll to continue reading.
According to Huntress, threat actors are chaining the two bugs to access vulnerable systems and execute arbitrary code on them. As of October 8, at least five organizations had been targeted.
“Huntress observed threat actors exploiting the vulnerabilities to gain unauthenticated remote code execution and deploy webshells on exposed systems,” the cybersecurity firm notes.
It also warns that CVE-2026-105134 can be exploited for unauthenticated RCE with System privileges through an API of the Replication Receiver component.
“The API contains an authentication bypass that could allow for a random token to substitute valid credentials. After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application,” Huntress explains.
After gaining initial access, the attackers conducted reconnaissance and deployed XMRig cryptominers disguised as Microsoft Edge. They also planted an AI-assisted PowerShell script to monitor Task Manager and terminate it if it remains open for too long.
They also achieved persistence by creating a Windows service masquerading as Microsoft Edge Update to execute a modified copy of the legitimate NSSM utility named msedge.exe with System privileges.
“NSSM can support other programs to ensure they stay running and restart after a crash or reboot, and threat actors in this incident likely used it to maintain persistence for edge.exe, while disguising the service-related binary as a legitimate-looking file,” Huntress notes.
In one attack, the hackers deployed WinRing0x64.sys, a legitimate but vulnerable kernel driver that enabled the cryptocurrency miner to operate with kernel-level access.
“Organizations should restrict AhsayCBS management interface web access, as the exploit targets the externally accessible web app service on the host. Access should be limited to trusted IP addresses only or require VPN,” Huntress recommends.
Related: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
Related: Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
Related: Cisco Patches a Dozen Critical Vulnerabilities
Related: Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication