AhsayCBS: unpatched flaws exploited for web shells and XMRig

Two vulnerabilities in AhsayCBS, the centralised console used to manage cloud backup servers, are being exploited in real attacks and still have no fix. They are CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (operating system command injection). The detection and response company Huntress observed attackers chaining them to run code remotely without authentication, install JSP web shells and launch the XMRig cryptocurrency miner disguised as Microsoft Edge. According to Huntress, 10.3.4, the latest available version, is also vulnerable.

What happened

AhsayCBS, developed by Ahsay Systems, manages backup policies, storage and users. It is widely used by managed service providers (MSPs) and system integrators, who run their customers’ backups on it.

The two vulnerabilities were disclosed on 4 October. According to SecurityWeek, NIST warned at the time that exploit code had already been released and that AhsayCBS versions up to 10.3.2 were affected. BleepingComputer reports instead that the flaws were listed as fixed in 10.3.2. The sources agree on one point: after further investigation, Huntress determined that 10.3.4 is vulnerable too.

The malicious activity was observed on 7 October, according to BleepingComputer. As of 8 October, at least five organisations had been targeted. The sources do not name the victims or attribute the attacks to a specific group. BleepingComputer asked Ahsay when fixes would be available, but had no reply by the time of publication.

Technical details

• CVE-2026-105133: authentication bypass, with a public exploit.
• CVE-2026-105134: operating system command injection.
• Severity: according to BleepingComputer, one of the two is critical and the other medium severity; the sources do not say which.
• Affected versions: all versions up to and including 10.3.4, according to Huntress. No fixed version exists at the moment.
• Vector: network, through the application’s web service exposed to the Internet.

Huntress, quoted by SecurityWeek, describes the entry point: an API of the Replication Receiver component contains an authentication bypass that lets a random token substitute valid credentials. This gives unauthenticated remote code execution with SYSTEM privileges. SecurityWeek links this behaviour to CVE-2026-105134, while BleepingComputer describes a two-step chain: CVE-2026-105133 first, to bypass authentication, then CVE-2026-105134 to execute code.

The observed attack chain

1. Initial access: exploitation of the two vulnerabilities on the exposed web interface.
2. Web shell: the attacker configures a malicious receiver and drops a JSP web shell into the application directory served by AhsayCBS.
3. Reconnaissance of the compromised system.
4. Cryptomining: download of XMRig under the name edge.exe.
5. Persistence: a Windows service called MicrosoftEdgeUpdateSvc runs msedge.exe, which is actually a modified copy of the legitimate NSSM (Non-Sucking Service Manager) utility, with SYSTEM privileges. NSSM keeps the miner running and restarts it after a crash or reboot.
6. Concealment: the PowerShell script Taskgmr.ps1, which Huntress believes was written with AI assistance, stops the service when Task Manager opens and restarts it when Task Manager closes. It also closes Task Manager at 6 p.m. local time, or if it stays open for more than an hour overnight.
7. Vulnerable driver: in one case the attacker installed WinRing0x64.sys, a legitimate but vulnerable driver, to give the miner kernel-level access and more hardware resources.

The miner disguised as Microsoft Edge is also the focus of the headline from The Hacker News, the third source, whose full text could not be retrieved.

MITRE ATT&CK (our mapping of the behaviour described): T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1059.001 PowerShell, T1543.003 Windows Service, T1036.004 Masquerade Task or Service, T1036.005 Match Legitimate Name or Location, T1496 Resource Hijacking.

Impact for European and Italian companies

In the observed attacks the goal was mining, but a web shell with SYSTEM privileges on a backup console gives the attacker much more. Backup policies, storage and users pass through it, often for many customers of the same provider. Whoever controls that console can prepare more serious attacks, ransomware included, starting from the very tool used to restore data.

MSPs fall within the scope of NIS2 (in Italy, Legislative Decree 138/2024). For them, the compromise of a platform used to deliver services to customers may be a significant incident to be reported to the national CSIRT, in Italy CSIRT Italia at ACN. The duty to inform affected customers should also be assessed. If the backups contain personal data, a breach notification to the data protection authority under the GDPR should be considered. In healthcare, where backups hold clinical data, the availability and integrity of the copies are a requirement for service continuity.

What to do now

1. Inventory: find every AhsayCBS instance, including those run by your backup providers. Treat them as vulnerable whatever the version, 10.3.4 included.
2. Restrict access to the web interface, as Huntress recommends: only from trusted IP addresses or through a VPN. This is the main measure until a patch is released.
3. Look for signs of compromise:
   • a MicrosoftEdgeUpdateSvc service, or other services named after Microsoft Edge that run executables outside the browser’s installation folders;
   • msedge.exe or edge.exe files in unusual paths, the Taskgmr.ps1 script and the WinRing0x64.sys driver;
   • new JSP files in the AhsayCBS application directory and replication receivers you did not configure;
   • Task Manager closing by itself, abnormal CPU usage, outbound connections to mining pools.
4. Use the indicators published by Huntress: the IoCs and the four Sigma detection rules.
5. If you find evidence: preserve logs and evidence, isolate the host and handle the event as an incident. Huntress recommends a full restore of the host from a safe backup, because the attacker may have left other backdoors. Then change the console’s administrative credentials.
6. Follow Ahsay’s updates and apply the fix as soon as it is available, then check that the installed version is actually fixed.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet and which products are recognised on them: an AhsayCBS console reachable by anyone shows up among the findings. On Windows servers, the ARX Sentry agent collects logs and security events, processes, ports and file changes in the chosen folders, such as the AhsayCBS application directory; suspicious execution and persistence events are grouped and highlighted. ARX Shield lets you isolate a suspicious machine from the network, and with ARX Trace analysts can launch collections and searches for the indicators across several servers.

Last updated: 9 October 2026