Unpatched AhsayCBS Flaws Exploited in the Wild
Threat actors are actively chaining unpatched vulnerabilities in the AhsayCBS backup solution to achieve remote code execution, deploy webshells, and install cryptominers.
Radwan AbdulhadiEditor and technology writer
Active Exploitation of AhsayCBS Vulnerabilities
Hackers have begun actively exploiting two unpatched vulnerabilities residing within the AhsayCBS backup solution to achieve remote code execution, as <a href="https://www.huntress.com/blog/ahsaycbs-flaws-exploit">warned</a> by cybersecurity firm Huntress. AhsayCBS is a centralized cloud backup server management console developed by Ahsay Systems that provides storage, backup policies, and user management capabilities. It is widely utilized by system integrators and managed service providers (MSPs).
The security defects are tracked as <a href="https://nvd.nist.gov/vuln/detail/cve-2026-105133">CVE-2026-105133</a> and <a href="https://nvd.nist.gov/vuln/detail/cve-2026-105134">CVE-2026-105134</a>. These flaws permit attackers to manipulate arguments within specific functions of the management tool, successfully bypassing authentication mechanisms and facilitating arbitrary OS command injections on target hosts.
Disclosure Timeline and Affected Versions
The vulnerabilities initially came to light on October 4, when NIST issued warnings indicating that exploit code targeting the defects had been released into the wild. At the time of disclosure, NIST noted that all AhsayCBS software versions up to and including version 10.3.2 were directly affected by the flaws.
Subsequent analysis revealed that the security risks extended further. Huntress issued a notification on Thursday stating that the latest AhsayCBS version, 10.3.4, is also affected by the vulnerabilities. Because a comprehensive vendor patch is not yet available, organizations utilizing the software have been urged to restrict access to the management interface immediately and thoroughly investigate their environments for any signs of compromise.
Attack Mechanics and Chaining Methods
According to telemetry and analysis from Huntress, active threat actors are chaining the two vulnerabilities together to gain unauthorized access to vulnerable systems and execute arbitrary code. As of October 8, researchers confirmed that at least five distinct organizations had been targeted in these campaigns.
The cybersecurity firm observed threat actors leveraging the defects to gain unauthenticated remote code execution and subsequently deploy webshells across exposed systems. Specifically, <a href="https://nvd.nist.gov/vuln/detail/cve-2026-105134">CVE-2026-105134</a> can be exploited for unauthenticated remote code execution with high-level System privileges by interacting with an application programming interface (API) belonging to the Replication Receiver component. This API includes an authentication bypass flaw allowing a random token to stand in for valid credentials, enabling attackers to configure a malicious receiver and drop a Java Server Page (JSP) webshell directly into the CBS application directory.
Post-Exploitation Activity and Persistence Techniques
Following initial access, attackers conducted internal reconnaissance and deployed XMRig cryptominers disguised under the guise of Microsoft Edge. To avoid detection, the threat actors planted an AI-assisted PowerShell script designed to continuously monitor Task Manager and automatically terminate the utility if left open for too long.
Persistence was established by creating a rogue Windows service masquerading as a Microsoft Edge Update. This service was used to execute a modified copy of the legitimate NSSM utility—named msedge.exe—with System privileges. NSSM allows programs to remain running and automatically restart after a crash or system reboot, enabling the actors to maintain steady access. In certain attacks, hackers also deployed WinRing0x64.sys, a legitimate yet vulnerable kernel driver, allowing the cryptocurrency miner to operate directly with kernel-level access.
Recommended Mitigations and Security Guidance
Because official patches remain unavailable for the newly discovered defects, security experts emphasize the importance of immediate hardening measures. Huntress strongly recommends that organizations restrict web access to the AhsayCBS management interface, noting that the exploit targets the externally accessible web application service running on the host.
To minimize exposure, administrative access should be strictly limited to trusted IP addresses only or routed exclusively through a secure virtual private network (VPN). Administrators should also monitor systems for anomalous user accounts, unexpected processes, unauthorized webshell files, or unfamiliar Windows services resembling system updates.
Sources
- SecurityWeekUnpatched AhsayCBS Vulnerabilities Exploited in the Wild
Continue chronologically
Related stories
Unpatched AhsayCBS Flaws Exploited for Webshells
Threat actors are actively exploiting unpatched critical and medium-severity vulnerabilities in the AhsayCBS backup management platform.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
ConnectWise Shuts Down Cloud Backup After M365 Breach
ConnectWise has disabled customer access to its Cloud Backup service following a supply-chain attack that compromised Microsoft 365 tenants.
Siemens Software Center Vulnerability Exploited in ClickFix Attacks
Siemens reveals active exploitation of a DLL side-loading vulnerability in its Software Center linked to the Romulus ClickFix malware delivery campaign.
