Update AhsayCBS 10.3.4: Huntress finds chained CVEs still allow webshells and miners on unpatched systems
Huntress researchers report that threat actors are chaining two vulnerabilities in AhsayCBS to deploy webshells and disguised cryptocurrency miners on unpatched systems.
Key points
- Attackers chain CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute commands as SYSTEM.
- Huntress found that AhsayCBS version 10.3.4 remains vulnerable, contradicting earlier vendor guidance that it was fixed.
- Five organisations were targeted in attacks observed starting on 7 October 2026, with miners disguised as Microsoft Edge files.
Managed service providers and system integrators using AhsayCBS must restrict access to their management interfaces immediately. Huntress researchers confirmed that threat actors are actively exploiting two unpatched vulnerabilities in the backup platform to deploy webshells and cryptocurrency miners. The exploitation campaign was first observed on 7 October 2026, with five organisations targeted by 8 October.
How are attackers compromising AhsayCBS servers?
Threat actors are chaining two specific vulnerabilities to gain full control of Windows hosts running AhsayCBS. According to Huntress, attackers first use CVE-2026-105133, a medium-severity authentication bypass flaw in the checkSysPwd function, to circumvent login requirements. They then leverage CVE-2026-105134, a critical remote command injection flaw in the Replication Receiver endpoint, to execute arbitrary commands.
This combination allows attackers to operate with NT AUTHORITY\SYSTEM privileges. The National Vulnerability Database lists CVE-2026-105134 with a CVSS 4.0 score of 9.3. Huntress noted that the attack pattern resembles earlier z0Miner campaigns against WebLogic servers, though this similarity indicates a shared method rather than the same operators.
Why is version 10.3.4 still at risk?
Conflicting information regarding the fix status of these flaws complicates mitigation efforts. The NVD entry for CVE-2026-105134, published on 4 October, identifies version 10.3.4 as the patched release. However, Huntress issued an update on 8 October stating that further investigation revealed version 10.3.4 is also affected by both vulnerabilities.
This discrepancy means that administrators who updated to 10.3.4 believing their systems were secure may remain exposed. Huntress explicitly warned that the latest available version is vulnerable, making the vendor’s previous guidance misleading for administrators assessing their current exposure levels.
What do attackers install after gaining access?
Once inside the system, attackers deploy Java Server Page webshells within the application’s web directory to maintain persistent access. Huntress observed the download of several files from an Alibaba Cloud Object Storage endpoint, including edge.exe, msedge.exe, Taskgmr.ps1, and config.json. The file edge.exe is identified as the XMRig cryptocurrency miner, while msedge.exe is a modified copy of the Non-Sucking Service Manager utility.
The miner persists via a Windows service named MicrosoftEdgeUpdateSvc, which runs the disguised NSSM binary with SYSTEM privileges. This service restarts the miner after crashes or reboots. Additionally, the Taskgmr.ps1 PowerShell script conceals mining activity by stopping the service when Task Manager opens and terminating the manager itself at 6 p.m. local time or after an hour of use.
What is the current status of a fix?
BleepingComputer contacted AhsayCBS regarding plans to address these flaws but had not received a response at the time of publication. Huntress has not confirmed the availability of a patched version beyond 10.3.4, which is now known to be vulnerable. Until a definitive fix is provided, administrators are advised to restrict access to the management interface to trusted IP addresses only.
If a compromise is confirmed, Huntress recommends performing a full restore of the host from a safe backup. This is necessary because attackers may have installed additional backdoors for prolonged persistence that are not immediately visible through standard remediation steps.
What to do and how to stay safe: AhsayCBS
- Restrict network access to the AhsayCBS management interface so that only trusted IP addresses can connect to the service.
- Monitor system processes for the MicrosoftEdgeUpdateSvc service or any instances of edge.exe and msedge.exe that are not part of legitimate browser installations.
- Check for the presence of Taskgmr.ps1 PowerShell scripts in temporary folders, as these may be used to conceal malicious activity from administrators.
- Review firewall logs for outbound connections to unknown IP addresses on port 8029, which Huntress identified as a communication channel for the XMRig miner.
Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE IDs are being exploited in these attacks?
Attackers are chaining CVE-2026-105133, an authentication bypass, with CVE-2026-105134, a critical command injection flaw.
Is AhsayCBS version 10.3.4 safe from these vulnerabilities?
No, Huntress confirmed that version 10.3.4 is affected by both vulnerabilities, contradicting earlier guidance that it contained the fix.
How many organisations have been targeted so far?
Huntress observed attacks targeting at least five organisations between 7 October and 8 October 2026.
