AhsayCBS flaws CVE-2026-105133 and 105134 exploited for webshells and cryptomining

What happened

On October 4, 2026, the NVD published two vulnerabilities in AhsayCBS (Cloud Backup Server), the management console for Ahsay's backup software, widely used by managed service providers (MSPs) and system integrators: CVE-2026-105133 and CVE-2026-105134. Within days, they were being exploited in the wild.

According to security firm Huntress, exploitation began on October 7 at 23:20 UTC (October 8, 08:20 JST). By October 8, Huntress had seen five organizations targeted.

The two flaws

• CVE-2026-105133 (medium): improper authentication in the checkSysPwd function (ApiStructsAction.java).
• CVE-2026-105134 (critical): in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component, an authentication bypass allows unauthenticated remote code execution as NT AUTHORITY\SYSTEM.

Attackers chain them: the first bypasses authentication, the second runs code. They then configure a malicious receiver and drop a JSP webshell into the directory the application serves.

What the attackers did next

Huntress describes:

• JSP webshells right after exploitation;
• downloads with curl and certutil of files hosted in an Alibaba Cloud OSS bucket;
• the XMRig miner renamed edge.exe, plus a modified NSSM copy named msedge.exe, running as a fake MicrosoftEdgeUpdateSvc service with SYSTEM privileges;
• a PowerShell script (Taskgmr.ps1) that appears AI-assisted and pauses mining whenever Task Manager is opened;
• in one case, the vulnerable WinRing0x64.sys driver, giving the miner kernel-level hardware access.

The fix is still delicate

Huntress updated its report on October 8: version 10.3.4 is also vulnerable, contrary to early reports. In an October 10 alert, Ahsay said 10.3.4.0 did not fully fix the issue and recommends applying hotfix 10.3.4.45 (distributed to partners) and rebooting the server. Always check the official page before acting, as guidance may change.

What to do now (checklist)

1. Inventory: find out whether you or your MSP use AhsayCBS. Many SMEs outsource backup without knowing which software runs it.
2. Restrict access: the management console should not be exposed to the internet. Allow only trusted IPs or require a VPN.
3. Apply the hotfix Ahsay recommends and reboot.
4. Hunt for compromise: unexpected child processes of cbssvcX64.exe, edge.exe/msedge.exe in Temp folders, a MicrosoftEdgeUpdateSvc service, connections on port 8029, and WinRing0 downloads. Huntress published Sigma rules and IOCs.
5. If you find signs, re-image the host from a trusted image: attackers may have left other backdoors.
6. Test restores: a compromised backup server endangers your last line of defense against ransomware.

Why this matters for SMEs

Backup servers sit in a privileged position: they reach data from many customers and usually run with high permissions. When an MSP is hit, all of its customers are exposed. This time the goal was cryptomining, but the same access could be used to steal data or wipe backups before a ransomware attack.

Sources

• Huntress, "Threat Actors Exploit Critical AhsayCBS Flaws…" (Oct 8, 2026): https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• Ahsay patch announcement: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134
• BleepingComputer: https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
• SecurityWeek: https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/

---

Want to review the security of your backups or your MSP? KGA IT offers a free consultation: kga-it.com.