AhsayCBS Backup Server Vulnerability Exploited

An AhsayCBS backup server vulnerability is being exploited, and the version everyone was told to install did not fix it. Huntress saw attackers chain two flaws from October 7 to run code as SYSTEM on exposed Ahsay Cloud Backup Servers. On October 8 it found that 10.3.4, the release the public CVE entries call fixed, is affected as well. Ahsay confirmed this on October 10 and shipped hotfix 10.3.4.45. Install it, and keep the management interface off the internet.

What Happened

The AhsayCBS backup server vulnerability is really two flaws, which NVD published as CVE-2026-105133 and CVE-2026-105134 on October 4. The first (CVSS v4 5.5) is an improper authentication flaw in the checkSysPwd function. The second (CVSS v4 9.3) is an OS command injection in the Replication Receiver, reachable through /rps/api/json/UpdateReceivers.do, where an authentication bypass lets a random token stand in for valid credentials. Chained, they give an unauthenticated attacker remote code execution as NT AUTHORITY\SYSTEM.

Huntress saw the first exploitation at 23:20 UTC on October 7 and counted five targeted organizations by October 8. After exploitation the attackers configure a malicious receiver and drop a JSP web shell into the directory the application serves. On several hosts they then used cbssvcX64.exe to download a Monero miner named edge.exe and a modified copy of the NSSM service manager named msedge.exe, which runs the miner as a service called MicrosoftEdgeUpdateSvc.

The patch status was the problem. The public CVE entries said the flaws are fixed in 10.3.4. Huntress updated its write-up on October 8 to say 10.3.4 is also affected. On October 10 Ahsay confirmed that 10.3.4.0 had not adequately addressed either flaw and told version 10 partners to install hotfix 10.3.4.45 and reboot; Huntress names hotfix 9.15.2.70 for versions 7 to 9. Huntress verified that the 10.3.4.45 hotfix mitigates the initial entry point of the chain. We have not seen Ahsay’s own advisory. As of October 14, we found no CISA KEV entry for either CVE.

Why It Matters

The cryptominer is the visible part. A web shell running as SYSTEM on a backup server is a foothold on a machine that normally holds credentials and network access to everything it protects. Huntress describes AhsayCBS as the management console used mainly by managed service providers and system integrators, so one compromised console can sit in front of many customers’ data. Beyond mining, the reports show no further activity; the rest is our assessment.

For DACH, we have no data on how widely AhsayCBS is installed and no known German victims. The pattern is familiar from the Veeam backup server flaw (CVE-2026-44963) we covered in June: backup infrastructure sits outside the patching and monitoring routine, and, in our experience, its web console is often reachable from the internet.

What You Should Do Now

1. Restrict the AhsayCBS web console and the Replication Receiver endpoint today. Allow trusted IP addresses only, or require a VPN. This is Huntress’s primary mitigation because the exploit targets the externally reachable web service.
2. Check your version and install hotfix 10.3.4.45 (version 10, including 10.3.4.0) or 9.15.2.70 (versions 7 to 9), then reboot and verify the running build. A plain upgrade to 10.3.4.0 is not a fix.
3. Hunt for the known indicators: child processes of cbssvcX64.exe or cbssvcX86.exe, unexpected JSP files in the CBS web directory, a service named MicrosoftEdgeUpdateSvc, edge.exe, msedge.exe and Taskgmr.ps1 in Temp folders, WinRing0x64.sys, and outbound traffic to the Alibaba Cloud storage host and the mining pool on port 8029.
4. The hotfix does not remove an attacker who is already in, so run this hunt first. If any indicator turns up, re-image the host from a trusted backup, as Huntress advises, because the attackers hid secondary backdoors. Treat credentials stored on or reachable from that server as exposed.
5. If you cannot say whether your console is internet-facing, scan your own address ranges today.

DIESEC Perspective

Backup consoles get less attention than firewalls and mail servers. Before asking which version you run, ask who can reach the login page from the internet.

Not sure whether your backup console is reachable from outside? Contact DIESEC for a rapid external exposure check and a compromise assessment of your backup infrastructure.

Sources: Huntress | NVD CVE-2026-105134 | eSecurity Planet | The Hacker News | BleepingComputer
Published: 2026-10-15 | Category: Vulnerabilities & Patches | ~4 min read