Are AhsayCBS Servers Safe From Unpatched CVE-2026-105133 Exploits?
Huntress researchers report active exploitation of two unpatched flaws in AhsayCBS, allowing attackers to deploy webshells and disguised cryptocurrency miners on MSP servers.
Key points
- Attackers chain CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute commands as SYSTEM.
- Huntress observed five targeted organisations, with exploitation first seen on 7 October 2026.
- Version 10.3.4 remains vulnerable despite vendor claims, with no confirmed fix available yet.
The short version
- Threat actors exploit two flaws in AhsayCBS to gain full control of backup management servers.
- The attack chain deploys JSP webshells and XMRig miners disguised as Microsoft Edge components.
- Huntress confirms that version 10.3.4 is affected, contradicting earlier vendor guidance.
The details
Researchers at Huntress identified active exploitation of two vulnerabilities in AhsayCBS, a management platform widely used by managed service providers and system integrators. The campaign began on 7 October 2026, with five organisations targeted by 8 October. Attackers chain CVE-2026-105133, a medium-severity authentication bypass in the checkSysPwd function, with CVE-2026-105134, a critical OS command injection flaw in the Replication Receiver endpoint. This combination allows unauthenticated remote command execution with NT AUTHORITY\SYSTEM privileges.
The National Vulnerability Database lists CVE-2026-105134 with a CVSS 4.0 score of 9.3. The NVD entry published on 4 October identifies version 10.3.4 as a fix. However, Huntress’s 8 October update states that version 10.3.4 remains vulnerable. This discrepancy creates significant confusion for administrators assessing their exposure. Huntress notes that the vendor has not provided a confirmed patch for the latest version as of publication.
The context
After gaining access, attackers deploy Java Server Page webshells within the application’s web directory to maintain persistence. They then download XMRig, disguised as edge.exe, and a modified Non-Sucking Service Manager binary named msedge.exe from an Alibaba Cloud Object Storage endpoint. A PowerShell script, Taskgmr.ps1, conceals mining activity by stopping the service when Task Manager opens and terminating the manager itself if it remains open for over an hour or after 6 p.m. local time.
The miner runs via a service named MicrosoftEdgeUpdateSvc, which restarts the process after crashes or reboots. Huntress observed the miner connecting to xmr.kryptex.network and an IP address on port 8029. In one instance, attackers also deployed the WinRing0x64.sys driver, likely to access additional hardware resources. Huntress contacted AhsayCBS regarding remediation plans but received no response before publication.
Next steps
Administrators should restrict access to the AhsayCBS management interface to trusted IP addresses immediately. Huntress advises investigating signs of compromise, such as unexpected services or network connections to mining pools. If a breach is confirmed, a full restore from a safe backup is recommended, as attackers may install additional backdoors. No patch has been confirmed for version 10.3.4 yet.
Background: Threat actors
Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.
Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies
What to do and how to stay safe: AhsayCBS
- Restrict inbound access to the AhsayCBS management console to known administrative IP ranges only.
- Monitor for new Windows services named MicrosoftEdgeUpdateSvc or processes running from temporary directories.
- Check for PowerShell scripts that interact with Task Manager or hide CPU usage spikes.
- Verify that your AhsayCBS version is not 10.3.4, as it remains vulnerable despite vendor claims.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is version 10.3.4 of AhsayCBS patched against these vulnerabilities?
No, Huntress confirms that version 10.3.4 remains vulnerable to CVE-2026-105133 and CVE-2026-105134.
How do attackers hide the cryptocurrency mining activity?
They use a PowerShell script that stops the miner when Task Manager opens and terminates the manager itself.
What privileges do attackers gain after exploiting these flaws?
Attackers gain NT AUTHORITY\SYSTEM privileges, allowing full control over the Windows host.
