Key points
- Threat actors chain CVE-2026-105133 and CVE-2026-105134 to gain SYSTEM-level access on AhsayCBS servers.
- Huntress observed attacks targeting five organizations starting October 7, deploying XMRig miners disguised as Microsoft Edge.
- Version 10.3.4 remains vulnerable despite vendor guidance suggesting it contains fixes for these issues.
The short version
- Two vulnerabilities in AhsayCBS allow attackers to bypass authentication and execute arbitrary operating system commands.
- Huntress detected active exploitation campaigns deploying Java Server Page webshells and cryptocurrency mining software.
- The latest available version, 10.3.4, is affected, contradicting earlier reports that it included patches for these flaws.
The details
Threat actors are actively exploiting two security flaws in the AhsayCBS backup management platform to compromise servers and install cryptocurrency miners, according to researchers at Huntress. The campaign began on October 7, with Huntress observing attacks against at least five organizations. Attackers leverage CVE-2026-105133, a medium-severity authentication bypass, followed by CVE-2026-105134, a critical remote command injection flaw. This combination allows unauthorized users to execute commands with NT AUTHORITY\SYSTEM privileges on the Windows host.
The exploitation chain begins with bypassing login checks via the checkSysPwd function vulnerability. Once authenticated, attackers exploit the Replication Receiver endpoint to inject operating system commands. Huntress noted that attackers configured malicious replication receivers and placed Java Server Page webshells within the application’s web directory. These webshells provide persistent access to the compromised server. The activity resembles earlier z0Miner campaigns against WebLogic servers, though Huntress states this indicates a shared method rather than identical operators.
Following initial access, attackers downloaded several files from an Alibaba Cloud Object Storage endpoint. These included edge.exe, which was identified as the XMRig cryptocurrency miner, and msedge.exe, a modified copy of the Non-Sucking Service Manager utility. A PowerShell script named Taskgmr.ps1 was also deployed. Huntress believes this script may be AI-assisted, as it hides mining activity by stopping the service when Task Manager opens and restarting it when closed. The script also terminates Task Manager at 6 p.m. local time or after an hour of overnight use.
Persistence is achieved through a newly created Windows service named MicrosoftEdgeUpdateSvc. This service runs the modified NSSM binary with SYSTEM privileges, ensuring the miner restarts after crashes or reboots. The miner connects to mining pools including xmr.kryptex.network. In one instance, attackers also deployed the vulnerable WinRing0x64.sys driver, likely to unlock additional hardware resources for mining operations. Huntress first detected this specific activity on October 7, 2026, at 23:20:15 UTC.
The context
AhsayCBS is primarily used by managed service providers and system integrators to manage backup policies and user accounts. The platform’s management console is the target of these exploits. Confusion exists regarding patched versions. The National Vulnerability Database entry for CVE-2026-105134, published October 4, lists a CVSS 4.0 score of 9.3 and identifies version 10.3.4 as fixed. However, Huntress issued an update on October 8 stating that version 10.3.4 remains vulnerable to both flaws. This discrepancy creates significant risk for administrators who upgraded expecting protection.
BleepingComputer contacted AhsayCBS regarding plans to fix these flaws but had not received a response at the time of publication. The public availability of an exploit for the authentication bypass increases the likelihood of widespread automated scanning and exploitation. The chaining of these two specific CVEs allows attackers to move from unauthorized access to full system control rapidly.
What to watch
Administrators should monitor for the creation of the MicrosoftEdgeUpdateSvc service on AhsayCBS hosts. Look for the presence of edge.exe and msedge.exe in temporary directories, especially if they originate from external storage endpoints. Watch for PowerShell scripts that interact with Task Manager or modify service states based on user activity. Unusual outbound connections to port 8029 or known mining pool domains may also indicate compromise.
What to do and how to stay safe: AhsayCBS
- Restrict access to the AhsayCBS management interface to trusted IP addresses only to reduce exposure to automated scanning.
- Investigate hosts for the presence of JSP webshells in the application’s web directory, as these provide persistent attacker access.
- Check for the MicrosoftEdgeUpdateSvc service and verify that edge.exe and msedge.exe are legitimate binaries, not disguised miners.
- Perform a full restore of compromised hosts from safe backups, as attackers may have installed additional backdoors for prolonged persistence.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AhsayCBS versions are affected by these vulnerabilities?
Versions up to and including 10.3.4 are affected, despite earlier reports suggesting 10.3.4 contained fixes for these issues.
What do attackers do after exploiting these flaws?
Attackers deploy Java Server Page webshells and install XMRig cryptocurrency miners disguised as Microsoft Edge components to mine coins.
Is there a confirmed patch for these vulnerabilities?
No confirmed fix has been released for the latest version; Huntress reports that 10.3.4 remains vulnerable to both CVE-2026-105133 and CVE-2026-105134.
