If you run AhsayCBS – the management console used by managed service providers and system integrators to run Ahsay’s backup software – this is a stop-and-check-your-version alert. Two chained flaws are being exploited in the wild against internet-exposed servers to give attackers unauthenticated SYSTEM-level remote code execution. CISA added both to its Known Exploited Vulnerabilities catalog on October 14, confirming real-world attacks. Your backup server is the worst place on your network to get fully compromised – an attacker with SYSTEM there owns your recovery data and everything behind it.
Threat researchers at Huntress first observed exploitation on October 7, 2026, and by the next day counted at least five organizations targeted. Attackers are using the pair to drop web shells, plant Monero cryptocurrency miners disguised as Microsoft Edge, and quietly maintain persistence. This is not theoretical research – it is a live, financially motivated campaign.
What the vulnerabilities are. Both were disclosed by NVD on October 4, 2026.
CVE-2026-105133 is an authentication bypass in the checkSysPwd function inside com/ahsay/obs/api/ApiStructsAction.java. By manipulating the random argument, an unauthenticated attacker can bypass authentication checks entirely.
CVE-2026-105134 is a critical vulnerability in the Replication Receiver component – specifically the /rps/api/json/UpdateReceivers.do endpoint. It combines an authentication bypass with an OS command injection, and it lets an unauthenticated attacker execute arbitrary commands as NT AUTHORITY/SYSTEM, the highest-privilege account on Windows. The endpoint even accepts a random token in place of valid credentials. Huntress’s assessment gives the chain unauthenticated RCE.
How the attack plays out. Attackers chain the two flaws: first CVE-2026-105133 bypasses authentication, then CVE-2026-105134 delivers code execution. Once in, they configure a malicious replication receiver and drop a Java Server Page (JSP) web shell into the directory the CBS application serves. From there, the payloads flow in from an Alibaba Cloud storage bucket: an XMRig miner renamed edge.exe, a modified copy of the NSSM service wrapper renamed msedge.exe, a config.json, a PowerShell script, and in one case the vulnerable WinRing0x64.sys kernel driver to give the miner kernel-level hardware access.
The miner connects to a Monero pool, while a fake Windows service named MicrosoftEdgeUpdateSvc – designed to look like the genuine Edge update service – keeps it running with SYSTEM privileges. A PowerShell script watches for Task Manager and stops the mining service whenever it is opened, then restarts it when Task Manager closes, hiding the activity from even a diligent admin. It hashes out to evasion done with real effort.
Affected versions. NVD’s original record said versions up to 10.3.2 were affected, but Huntress determined AhsayCBS 10.3.4 is also vulnerable. The initial 10.3.4.0 and 9.15.2.59 patches did not fully fix the issue. Ahsay has since released hotfixes that address the initial entry point: 10.3.4.45 for v10 installations and 9.15.2.70 for v7, v8, and v9. Apply the correct hotfix and then reboot the server – Ahsay is explicit that a reboot is required.
What you need to do right now.
Know if you run it. AhsayCBS is primarily MSP and integrator software. If you provide managed backup to customers, confirm which version your AhsayCBS server is on and whether you are exposed.
Patch immediately. Apply the 10.3.4.45 (v10) or 9.15.2.70 (v7/v8/v9) hotfix from the Ahsay partner portal, then reboot the server as instructed.
Do not expose the management interface. Huntress is explicit: the exploit targets the externally accessible web app. Restrict AhsayCBS management web access to trusted IPs only or require VPN access until you are certain you are clean.
Hunt for compromise before trusting the patch. Patching closes the door but does not evict someone already inside, and attackers hide secondary back doors for persistence. Look for unexpected child processes spawned from cbssvcX64.exe or cbssvcX86.exe, new or unexpected .jsp files in the CBS web application directory, a MicrosoftEdgeUpdateSvc service running from a Temp path, certutil.exe or curl downloads into Temp, an edge.exe/msedge.exe pair in Temp, and outbound connections to the mining pool on port 8029. Huntress published four Sigma rules specifically for this campaign.
Re-image if you see evidence of compromise. Because attackers maintain secondary back doors for extended persistence, Huntress recommends a full host re-image from a trusted backup rather than trying to clean an infected box.
Backup software holding a full set of our most sensitive data – hit with an unauthenticated SYSTEM RCE that is already on the CISA KEV list – should be at the top of your priorities. If you touch AhsayCBS, patch it today, lock down the interface, and inspect the host before you call it clean.