Summary

AhsayCBS is the backup console that managed service providers use to run backups for their customers, and two flaws in it are under active attack. CVE-2026-105133 is a broken login check, and CVE-2026-105134 allows operating system commands through the Replication Receiver component. Chained together, they give anyone on the internet remote code execution with full SYSTEM rights.

The first attacks occurred on October 7, 2026, three days after the CVEs were published, and counted five affected organisations within a day. The attackers dropped JSP webshells and an XMRig Monero miner renamed edge.exe to pass for Microsoft Edge, kept running by a service called MicrosoftEdgeUpdateSvc and hidden by a script that pauses mining whenever Task Manager is open. The fix has already changed once: 10.3.4 was listed as the safe version but was not, and Ahsay released hotfix v10.3.4.45 and v9.15.2.70.

Malware

Affected Product

CVEs

Vulnerability Details

1. #01

   The two flaws fall into different classes but were built to work together. CVE-2026-105133 is an improper authentication issue (CWE-287) in the checkSysPwd() function of com/ahsay/obs/api/ApiStructsAction.java. The function is meant to confirm that a caller holds valid system credentials, but it can be satisfied without them, so an unauthenticated request is treated as a trusted one. CVE-2026-105134 is an operating system command injection issue, mapping to CWE-78, in the Replication Receiver component exposed at /rps/api/json/UpdateReceivers.do. That API carries an authentication bypass of its own, where a random token can stand in for valid credentials, and it accepts input that reaches the underlying operating system shell.

2. #02

   In practice, the attackers chain them. The authentication weakness is used first to get past the login check, and the command injection is then used to run code on the host as NT AUTHORITY/SYSTEM. The entry point is the AhsayCBS web management interface, which is reachable from the internet on many deployments because that is how administrators and remote sites are expected to connect. No credentials, user interaction, or prior foothold are needed, which is what makes the chain so attractive for mass scanning. The first sign on a compromised host is usually an unexpected child process spawning from the AhsayCBS service binary, cbssvcX64.exe, because the web application runs inside that service process and anything an uploaded webshell executes appears underneath it.

3. #03

   AhsayCBS versions up to and including 10.3.4 are affected. Ahsay then issued its own notice on October 10 stating that build v10.3.4.0 did not fully address either vulnerability, and released hotfix v10.3.4.45 as the corrected build, to be applied from the partner portal and followed by a server reboot. Ahsay has described the affected scope only as affected v10 versions without naming specific builds, so until the vendor publishes an exact list, every v10 deployment below hotfix 10.3.4.45 should be treated as exposed. They have also released v9.15.2.70 hotfix for users affected by versions v7, v8, and v9.

4. #04

   Active exploitation is confirmed, not theoretical. Observing attacks on October 7, 2026 at 23:20:15 UTC, roughly 72 hours after publication, and identified five targeted organisations by October 8, with one further incident reported afterwards using the same techniques. The post-exploitation activity is consistent across victims: JSP webshells written into the web application directory, payloads retrieved into %TEMP% or AppData\Local\Temp using curl and certutil.exe, an XMRig miner connecting to a Monero pool on port 8029, a Windows service named to imitate Microsoft Edge Update for persistence, and a Task Manager-aware PowerShell script to hide the activity from anyone watching.

Vulnerabilities

Recommendations

1. 01
   Apply Hotfix v10.3.4.45, v9.15.2.70, and Reboot

   Ahsay has confirmed that its earlier v10.3.4.0 build did not fully address either CVE and has released hotfix v10.3.4.45 (v10 versions) and v9.15.2.70 (v7, v8, and v9 versions) as the real fix. Download it from the Ahsay partner portal, apply it to every AhsayCBS server, and reboot the host afterwards, since the vendor states the reboot is part of the remediation. If you consume AhsayCBS through a service provider, ask them directly for the exact build number running on your console.

2. 02
   Hunt for the Indicators Before Assuming You Are Clean

   Check your AhsayCBS hosts for the indicators listed in this advisory, including the payload hosting URLs, the miner and NSSM file hashes, the MicrosoftEdgeUpdateSvc service and newly written .jsp files in the web application directory. Also review process telemetry for any child process spawning from cbssvcX64.exe or cbssvcX86.exe that is not part of the service's normal startup and maintenance behaviour.

3. 03
   Take the Management Interface Off the Internet

   The exploit targets the externally accessible web application service on the host, so restrict web access to the AhsayCBS management interface to a short list of trusted IP addresses or require VPN. Keep this control in place even after the hotfix is applied, because it removes the attack path for the next flaw in the same interface rather than just this one.

4. 04
   Block the Mining and Payload Infrastructure

   Add the listed IP addresses, the Alibaba Cloud payload hosting domain and the Monero pool to your egress blocklists, and alert on outbound connections to non-standard ports such as 8029. Cryptomining needs a working outbound channel, so egress control both limits the damage and gives you a reliable detection signal.

5. 05
   Watch for Vulnerable Driver Loads

   The campaign loads WinRing0x64.sys, a legitimate but vulnerable kernel driver, to give the miner low-level hardware access. Enable Microsoft's vulnerable driver blocklist where you can, and alert on driver files being written into temporary folders or loaded from user-writable paths.

6. 06
   Treat Backup Infrastructure as Tier 0

   Backup consoles hold the keys to recovery and, for service providers, to many customer environments at once. Give them the same isolation, monitoring and administrative controls as domain controllers, keep them off the public internet by default, and make sure at least one backup copy is offline and outside the reach of the console itself.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

Patch Link

• Ahsay Partner Portalhttps://idp3.ahsay.com/idp/Authn/RemoteUser

References

• https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134
• https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update