Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

What it is

Huntress's write-up of exploitation of CVE-2026-105133 and CVE-2026-105134 in Ahsay Systems' AhsayCBS backup management console. NIST disclosed the pair on October 4, warning that exploit code was already public and that versions up to 10.3.2 were affected; Huntress's own testing found the then-current 10.3.4 build is also vulnerable.

How it works

The two CVEs allow attackers to manipulate function arguments to bypass authentication and inject OS commands. Specifically, CVE-2026-105134 targets an API in AhsayCBS's Replication Receiver component: the API has an authentication bypass that accepts a random token in place of valid credentials. Once in, the attacker configures a malicious "receiver" and drops a JSP webshell into the application directory served by the CBS app — giving unauthenticated RCE with System privileges.

Post-exploitation, observed attackers:

• Ran reconnaissance, then deployed XMRig cryptominers disguised as msedge.exe.
• Dropped an AI-assisted PowerShell script that watches for Task Manager and kills it if left open too long (likely to hide the miner's CPU usage).
• Established persistence via a Windows service masquerading as "Microsoft Edge Update," running a modified copy of the legitimate NSSM utility (renamed msedge.exe) with System privileges to keep the miner alive across reboots/crashes.
• In one incident, loaded WinRing0x64.sys — a legitimate but vulnerable signed kernel driver — in a BYOVD technique to give the cryptominer kernel-level access.

flowchart LR
    A[Unauthenticated attacker] --> B[Replication Receiver API]
    B -->|random token bypasses auth| C[CVE-2026-105134]
    C --> D[Malicious receiver + JSP webshell]
    D --> E[RCE as System]
    E --> F[XMRig miner as msedge.exe]
    E --> G[NSSM-based fake Edge Update service]
    E --> H[Load WinRing0x64.sys driver]
    H --> I[Kernel-level miner access]

Preconditions / Affected

All AhsayCBS versions up to and including 10.3.4 (NIST's initial advisory cited up to 10.3.2; Huntress confirmed 10.3.4 is also exploitable). The attack requires network access to the AhsayCBS management interface/Replication Receiver API — no credentials needed due to the auth bypass. No patch exists yet as of the article's publication.

What to do

No patch is available. Huntress's recommendations:

• Restrict access to the AhsayCBS management interface to trusted IP addresses only, or require VPN — the exploit targets the externally accessible web app service.
• Investigate exposed systems for signs of compromise (JSP webshells in the app directory, an "msedge.exe" service/process via NSSM, presence of WinRing0x64.sys, unusual PowerShell scripts monitoring Task Manager).

Caveats

At least five organizations were confirmed targeted as of October 8 — the actual scope may be larger. The article does not name the threat actor or provide IOCs (hashes, IPs) beyond the behavioral description.