Attackers chain two unpatched AhsayCBS flaws to get SYSTEM webshells and a hidden Monero miner

Huntress says attackers are chaining an authentication bypass (CVE-2026-105133) with an OS command injection (CVE-2026-105134) in Ahsay's AhsayCBS backup management server, which Huntress says is primarily used by managed service providers (MSPs) and system integrators. The chain gives unauthenticated code execution as NT AUTHORITY\SYSTEM. Huntress first saw exploitation at 2026-10-07 23:20:15 UTC and counted five targeted organizations as of October 8. Its post-exploitation findings include JSP webshells and an XMRig cryptominer disguised as Microsoft Edge. Huntress says version 10.3.4, which NVD's record named as the fix, is also affected. We found no Ahsay advisory or fixed release.

What happened

Both CVEs were published in the NVD on 2026-10-04 by the VulDB CNA. Both records say a public exploit exists. Three days later, Huntress observed attackers using them against exposed AhsayCBS servers. Huntress published on October 8, and SecurityWeek reported on October 9 that no patch was available.

Huntress reports that in the cases it saw, an attacker used CVE-2026-105133 to bypass authentication, then CVE-2026-105134 to run code. The attacker configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory that the CBS application serves. Huntress did not see one fixed sequence. In some incidents it saw .jsp webshells in the web application directory immediately after exploitation. Across several other incidents, the CBS service process (cbssvcX64.exe) spawned commands that downloaded a miner and its support files.

Why it matters

AhsayCBS is the central management console for Ahsay backup deployments. Huntress says it is primarily used by MSPs and system integrators, so one compromised server can sit in front of many client tenants' backup data and credentials. Other management and remote-access products have been hit recently (we covered ScreenConnect reverse-host hijacking, the Check Point management server zero-day and the Arista VeloCloud Orchestrator command injection). The chain needs no login, and the service runs as SYSTEM. Huntress counted five targeted organizations as of October 8. No source we read gives a count of internet-exposed instances.

The miner is the payload Huntress observed. The access gained is the larger concern, because a SYSTEM webshell on a backup server can serve any later purpose. Huntress says the attackers hid secondary backdoors for persistence.

Neither CVE is in CISA's Known Exploited Vulnerabilities catalog. We checked the KEV JSON (catalog version 2026.10.08, 1,739 entries) and found no entry for either CVE or for Ahsay.

Technical details

The flaws. NVD, using the VulDB record, describes them as follows.

These scores are the CNA's. NVD shows both records as Deferred, with no NVD-assigned score.

Affected versions. The sources disagree, and the difference matters.

• NVD: both flaws affect "Ahsay AhsayCBS up to 10.3.2", and "Upgrading to version 10.3.4" is said to fix them. The CNA data lists 10.3.0, 10.3.1 and 10.3.2 as affected and 10.3.4 as unaffected.
• Huntress: "AhsayCBS versions up through 10.3.4 are affected by this issue", and "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities."
• Ahsay's release list shows v10.3.4 dated 05-Aug-2026 as the newest CBS release, with no later version.

Post-exploitation, as Huntress describes it.

• Files were fetched into %TEMP% or the user's AppData\Local\Temp folder from hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, an Alibaba Cloud object storage host. The payloads (Taskgmr.ps1, edge.exe, msedge.exe, config.json, WinRing0x64.sys) sit under /javas/Office/win/. One command used curl -sk to write Taskgmr.ps1.
• The miner is XMRig renamed edge.exe. It connects to xmr.kryptex[.]network (51.195.127[.]124) on port 8029 with the user string krxYMRN97D/creativejs.
• A modified NSSM service wrapper, renamed msedge.exe, runs from Temp as the service MicrosoftEdgeUpdateSvc with SYSTEM privileges.
• Taskgmr.ps1 polls for Task Manager. When it opens, the script stops the service to hide mining; when it closes, the script restarts it. The script also kills Task Manager at 18:00 and if it has been left open for more than an hour overnight, using the endpoint's local time. Huntress calls it an "AI-assisted" script, given its commented code.
• In one incident Huntress saw certutil.exe download WinRing0x64.sys to Temp. It is a known legitimate but vulnerable kernel driver that gives low-level hardware access, so the miner could get kernel-level access to the hardware.

Indicators (SHA-256).

• msedge.exe: 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034
• edge.exe: 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d
• Taskgmr.ps1: 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21

Attacker IPs reported by Huntress: 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10, 123.202.208[.]37.

What defenders should do

1. Restrict the management interface. Huntress: "Organizations should restrict AhsayCBS management interface web access, as the exploit targets the externally accessible web app service on the host. Access should be limited to trusted IP addresses only or require VPN."
2. Do not treat 10.3.4 as safe. NVD's fix advice conflicts with Huntress's finding. Until Ahsay says otherwise, treat every CBS build through 10.3.4 as exposed and rely on access restriction. NVD's "up to 10.3.2" also covers older lines (Ahsay's release list shows v10.1.x and v9.x), so older builds are not safer.
3. Hunt for compromise. Look for new or unexpected receivers, new JSP files in the CBS web application directory, child processes spawned by cbssvcX64.exe or cbssvcX86.exe, a MicrosoftEdgeUpdateSvc service running from a Temp path, and the files and hashes above. Look for certutil.exe or curl downloads into Temp, and for outbound traffic to the listed hosts and the mining pool.
4. Use Huntress's Sigma rules. It published four, covering unexpected child processes from the service, fake Edge binaries with daemonized flags, PowerShell that watches Task Manager alongside service control, and WinRing0 driver downloads via the command line.
5. Re-image if compromised. Huntress: "companies should carry out a full host re-image from a trusted backup; as attackers have been able to hide secondary backdoors for extended persistence." Rotate credentials held on or reachable from the server.

What is still unclear

• Whether and when Ahsay will ship a fix, and whether it has acknowledged the flaws. Huntress says it contacted Ahsay and shared its research; we found no Ahsay advisory.
• How many AhsayCBS servers are exposed to the internet. No source gave a figure.
• Who is behind the activity. No source attributes it, and we do not.
• Whether the five organizations are the full scope. The count is Huntress's as of October 8.
• Why the NVD record named 10.3.4 as unaffected. Huntress says that is incorrect; NVD had not updated its record when we checked on 2026-10-12.

Sources

• Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• NVD API record, CVE-2026-105133
• NVD API record, CVE-2026-105134
• SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
• Ahsay: AhsayCBS v10.3.4 release notes and release list
• CISA Known Exploited Vulnerabilities catalog (JSON)