Unpatched AhsayCBS Flaws Exploited for Webshells
Malicious actors are chaining critical and medium-severity vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners across multiple targeted organizations.
Radwan AbdulhadiEditor and technology writer
Overview of the AhsayCBS Vulnerabilities
Threat actors are actively exploiting one critical and one medium-severity vulnerability that remain unpatched in the AhsayCBS backup management platform. AhsayCBS is a platform typically utilized by managed service providers and system integrators. According to details shared by [BleepingComputer](https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/), the malicious activity was observed on October 7 and has targeted at least five organizations.
The two security issues being leveraged in these ongoing attacks are [CVE-2026-105133](https://nvd.nist.gov/vuln/detail/cve-2026-105133), an authentication bypass vulnerability featuring a public exploit, and [CVE-2026-105134, which](https://nvd.nist.gov/vuln/detail/cve-2026-105134) can be utilized for operating system command injection.
Discovery and Vulnerability Status
Although both vulnerabilities were reportedly fixed in version AhsayCBS 10.3.2, researchers at managed detection and response firm [Huntress observed](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) that the security flaws also impact Ahsay 10.3.4, which is currently the latest version available.
In an update shared by the security firm, researchers noted that after further investigation, they determined Ahsay 10.3.4 remains vulnerable. In the observed attacks, threat actors chained the two security issues together, utilizing the authentication bypass flaw first followed by the command injection flaw for code execution.
Attack Mechanics and Tooling
Once access was successfully gained, researchers noted that the attacker performed reconnaissance, deployed Java Server Page webshells, and downloaded the XMRig cryptocurrency miner disguised under the file name edge.exe.
The cryptomining software maintains persistence on the host machine through a service named MicrosoftEdgeUpdateSvc, which executes msedge.exe—identified by researchers as a modified copy of the legitimate Non-Sucking Service Manager utility.
Concealment and Hardware Manipulation
To hide the unauthorized mining activity, the attackers utilized a PowerShell file named Taskgmr.ps1. Huntress believes this script was created with AI assistance. The script is configured to stop the mining service whenever Windows Task Manager is opened and restart it once Task Manager is closed.
Furthermore, the script automatically terminates Task Manager at 6 p.m. local time or if the application remains open for more than an hour during the overnight hours. In at least one analyzed case, the attacker also deployed the vulnerable WinRing0x64.sys driver, likely attempting to unlock additional hardware resources to boost mining operations.
Recommendations and Mitigations
BleepingComputer reached out to AhsayCBS to inquire about their plans to address the two unpatched flaws, but no response had been received by the time of publication.
Until an official patch is released and made available, Huntress advises system administrators to restrict access to the AhsayCBS management interface exclusively to trusted IP addresses, as well as thoroughly investigate any indicators of compromise.
If administrators confirm that a system has been compromised, they should perform a complete restore of the host using a safe backup. This step is crucial because attackers may have installed additional backdoors to ensure prolonged persistence.
Sources
- BleepingComputerUnpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Continue chronologically
Related stories
Unpatched AhsayCBS Flaws Exploited in the Wild
Cybersecurity researchers warn that unpatched vulnerabilities in the AhsayCBS backup solution are being actively exploited in the wild for remote code execution.
Siemens Software Center Vulnerability Exploited in ClickFix Attacks
Siemens reveals active exploitation of a DLL side-loading vulnerability in its Software Center linked to the Romulus ClickFix malware delivery campaign.
ConnectWise Shuts Down Cloud Backup After M365 Breach
ConnectWise has disabled customer access to its Cloud Backup service following a supply-chain attack that compromised Microsoft 365 tenants.
Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers
Threat actors are actively exploiting a critical command execution flaw tracked as CVE-2026-110447 in the Collabora Online built-in CODE server app for Nextcloud.
