Attackers are chaining two AhsayCBS flaws to get unauthenticated remote code execution on backup consoles. CVE-2026-105133 is an authentication bypass and CVE-2026-105134 is a command injection. Huntress first observed exploitation on 2026-10-07 at 23:20 UTC (2026-10-08 02:20 IDT). As of October 8, Huntress had seen five organizations targeted. The activity included JSP webshells, an XMRig cryptominer disguised as edge.exe, and Windows-service persistence. On October 10, Ahsay said its earlier patch, v10.3.4.0, "did not fully address" either CVE. Partners should apply hotfix v10.3.4.45 and then reboot. Neither CVE is in the CISA KEV catalog (catalog version 2026.10.08, checked 2026-10-12 07:37 IDT).
Technical Information
CVE-2026-105133: Improper authentication (CWE-287)
- Component: the checkSysPwd function in the AhsayCBS API (com/ahsay/obs/api/ApiStructsAction.java).
- CVSS 4.0: 5.5 (Medium), scored by VulDB as CNA (VDB-413350, EUVD-2026-92079).
- NVD status: Deferred.
CVE-2026-105134: OS command injection (CWE-77 / CWE-78)
- Component: the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do.
- CVSS 4.0: 9.3 (Critical), scored by VulDB as CNA (VDB-413351, EUVD-2026-92078).
- NVD status: Deferred.
The chain. Huntress reports that attackers use CVE-2026-105133 to bypass authentication and then CVE-2026-105134 to execute code. Together they give unauthenticated remote code execution, which Huntress describes as running as NT AUTHORITY\SYSTEM. The Critical 9.3 score belongs to the command injection (CVE-2026-105134), not the auth bypass.
Observed activity (per Huntress, 2026-10-08)
- Suspicious child processes spawned from cbssvcX64.exe.
- A malicious replication receiver configured, and a JSP webshell dropped into the CBS-served application directory.
- Files fetched to %TEMP%: Taskgmr.ps1, msedge.exe, edge.exe and config.json. In one incident, WinRing0x64.sys was also fetched via certutil.
- An XMRig miner named edge.exe, with mining-pool connections on port 8029.
- Persistence through a Windows service named MicrosoftEdgeUpdateSvc. The service runs msedge.exe, a modified NSSM, which Huntress says runs as SYSTEM.
- Taskgmr.ps1 stops the service whenever Task Manager is open. Huntress says the script "appears to be an AI-assisted script."
- No data theft or exfiltration of backups has been reported, and no threat actor has been named.
Timeline (UTC; IDT where helpful)
| Date / time | Event |
|---|---|
| 2026-10-03 ~13:18 UTC | VulDB creates entries VDB-413350 and VDB-413351 |
| 2026-10-04 07:16 UTC | CVEs published to NVD (CNA: VulDB) |
| 2026-10-06 15:04 UTC | Last NVD modification; status Deferred |
| 2026-10-07 23:20 UTC (10-08 02:20 IDT) | Huntress first observes exploitation |
| 2026-10-08 | Huntress publishes: five organizations targeted; webshells, XMRig |
| 2026-10-08 22:00 UTC | Huntress update: 10.3.4 also affected |
| 2026-10-09 | SecurityWeek and BleepingComputer report the activity |
| 2026-10-10 | Ahsay notice: v10.3.4.0 insufficient; apply hotfix v10.3.4.45 and reboot |
| 2026-10-12 07:37 IDT | KEV check: neither CVE listed (catalog 2026.10.08) |
Affected Product Versions
- Vendor statement: Ahsay says "affected v10 versions" and does not list specific builds.
- v10.3.4.0 is not sufficient. Ahsay says it "did not fully address" CVE-2026-105133 and CVE-2026-105134. Huntress also reported 10.3.4 as affected.
- Remediation build: AhsayCBS hotfix v10.3.4.45. It is available only through the partner portal ("A valid partner portal login account is required").
Rescana's conservative guidance: until Ahsay publishes exact affected builds, treat any v10 build below hotfix 10.3.4.45 as potentially exposed.
Workaround and Mitigation
Vendor actions (Ahsay, 2026-10-10)
- Apply the AhsayCBS v10.3.4.45 hotfix from https://www.ahsay.com/en/hotfix-v10-partner-only (partner-portal login required).
- Reboot the server after applying the hotfix.
We found no independent confirmation that v10.3.4.45 fully fixes the flaws. The fix is vendor-stated only. Ahsay's notice gives no instructions for checking whether a server was compromised.
Huntress recommendations
- Restrict the AhsayCBS management interface to trusted IPs or VPN.
- Check for the indicators listed below. Look especially for JSP webshells in the CBS application directory, unexpected replication receivers, unusual child processes of cbssvcX64.exe, and a MicrosoftEdgeUpdateSvc service.
- If you find a compromise, fully re-image the host from a trusted backup.
- Huntress has published four Sigma rules for this activity (repo path 2026/2026-10/AhsayCBS_XMRig_Miner).
Indicators of Compromise
All indicators below were published by Huntress (2026-10-08) and are defanged here. Ahsay has not published any indicators.
Network infrastructure
- 177.4.12[.]11 (AS140227, Hong Kong)
- 38.60.252[.]110 (AS154177, Vietnam)
- 107.191.47[.]199 (AS20473 Vultr, France)
- 185.220.236[.]49 (AS38136, Taiwan)
- 104.234.26[.]10 (AS134677, United States)
- 123.202.208[.]37 (AS9269, Hong Kong)
Payload hosting (Alibaba Cloud OSS)
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/edge.exe
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/msedge.exe
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/config.json
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/WinRing0x64.sys
Mining pool
- Pool URL: xmr.kryptex[.]network:8029
- Pool user: krxYMRN97D/creativejs
- Pool IP: 51.195.127[.]124:8029
File hashes (SHA256)
- msedge.exe (modified NSSM): 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034
- edge.exe (XMRig miner): 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d
- Taskgmr.ps1: 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21
Host artifact
- Windows service name: MicrosoftEdgeUpdateSvc
MITRE ATT&CK (techniques as listed by Huntress) T1608.001, T1190, T1059.001, T1059.003, T1569.002, T1505.003, T1543.003, T1036.004, T1036.005, T1564, T1057, T1124, T1105, T1071.001, T1571, T1496.001.
What This Means for Third-Party Risk
Incidents like this are when vendor reviews need to be fast and accurate at the same time. Huntress notes that AhsayCBS is mainly used by MSPs and system integrators to host and manage client backups. If one of your MSPs or vendors runs an exposed console, that is fourth-party exposure to your data. A SYSTEM-level compromise of a backup server matters even when the payload seen so far is a miner.
Rescana suggests asking each relevant vendor and MSP:
- Do you, or any of your subprocessors, run AhsayCBS?
- What exact build are you on? We expect v10.3.4.45 or later.
- Is the management interface restricted to trusted IPs or VPN?
- Have you checked for JSP webshells, unknown replication receivers, new services such as MicrosoftEdgeUpdateSvc, miners, and the Huntress IoCs?
- If you found a compromise, did you re-image the host and verify the integrity of client backups?
If a vendor answers "We're on 10.3.4," keep the item open. Ahsay says v10.3.4.0 did not fully address the flaws.
Want a faster, accurate way to run questions like these across your vendors? Book a demo.
Forward this to your TPRM owner: AhsayCBS backup consoles, which MSPs often run for their clients' backups, are being exploited through a two-CVE chain. The vendor's 10.3.4.0 patch was insufficient, and the fix is hotfix 10.3.4.45 plus a reboot. Ask your MSPs and backup vendors whether they run AhsayCBS, what exact build they are on, and whether they have hunted for compromise.
