AhsayCBS: Two Flaws Exploited, Ahsay Releases New Patch After First Fix Failed

Detection and response firm Huntress reported on October 8, 2026 the active exploitation of two vulnerabilities in AhsayCBS, a backup server from vendor Ahsay. The first attacks were observed on October 7. As of October 8, five organizations had been targeted. The two flaws, CVE-2026-105133 and CVE-2026-105134, had been made public on October 4 in the U.S. NVD database.

A patch that is not enough

According to the CVE records published in the NVD, versions up to 10.3.2 were affected and version 10.3.4 fixed both flaws. But Huntress published an update on the evening of October 8: version 10.3.4, the latest, is also affected. Huntress says it contacted the vendor. BleepingComputer also reached out: when its article was published on October 9, Ahsay had not responded. No effective patch was available at the time.

How the attack works

According to Huntress, the attacker chains the two flaws:

• CVE-2026-105133, of medium severity, allows authentication bypass;
• CVE-2026-105134, critical, affects the Replication Receiver component. It allows unauthenticated code execution with SYSTEM privileges.

The attacker then configures a malicious replication receiver and drops JSP webshells, small programs that give remote access to the server. They also install the Monero miner XMRig, disguised as the Edge browser (edge.exe). The miner is kept running by a fake Windows service, MicrosoftEdgeUpdateSvc. A PowerShell script, Taskgmr.ps1, which Huntress says was likely written with the help of AI, stops the mining as soon as Task Manager is opened. In one case, the attacker also loaded the vulnerable driver WinRing0x64.sys to access hardware more directly.

Mining appears to be the visible goal. However, Huntress warns that the attacker may have installed other backdoors.

What to do

• Restrict access to the AhsayCBS administration interface to trusted IP addresses only, or place it behind a VPN.
• Look for traces: unusual child processes of cbssvcX64.exe, a suspicious MicrosoftEdgeUpdateSvc service, edge.exe or msedge.exe files outside the normal Edge folders, and connections to xmr.kryptex[.]network on port 8029.
• If compromised, rebuild the server from a clean backup rather than cleaning it.
• Use the indicators of compromise and the four Sigma rules published by Huntress, and watch for the release of a patch from Ahsay.

Update of October 14, 2026

There is news on the flaws in the AhsayCBS backup server, exploited since October 7 to drop webshells and a cryptocurrency miner. According to eSecurity Planet, vendor Ahsay acknowledged, in an advisory dated October 10, that version 10.3.4.0 did not properly fix CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (remote code execution). It is asking partners using version 10 to install patch 10.3.4.45, then restart their servers.

This patch is distributed through Ahsay's partner portal, which is restricted to authenticated customers. Huntress says it independently verified that version 10.3.4.45 blocks the initial entry point, to which earlier version 10 releases remained vulnerable. In addition, an update does not remove access an attacker has already installed. Servers exposed since October 7 must therefore be examined for the traces described by Huntress, and rebuilt if they were compromised.