AhsayCBS auth bypass and RCE flaws exploited with no patch

Huntress has seen attackers chain two AhsayCBS vulnerabilities, an authentication bypass and an unauthenticated remote code execution flaw, to run code as SYSTEM on backup servers and install webshells and a cryptominer. There is no patch, and Huntress says the latest release, 10.3.4, is affected despite early reporting that it was not.

What happened

The two CVEs were disclosed on October 4, 2026. Huntress first observed exploitation on October 7 at 23:20:15 UTC and had seen five organizations targeted by the time it published on October 8.

• CVE-2026-105133 (Huntress rates it medium) is an authentication bypass in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java.
• CVE-2026-105134 (Huntress rates it critical) is unauthenticated remote code execution through /rps/api/json/UpdateReceivers.do in the Replication Receiver component. Code runs as NT AUTHORITY\SYSTEM.

According to Huntress, the attackers bypassed authentication, configured a malicious replication receiver, and wrote JSP webshells into the web application directory. Huntress spotted the compromises through suspicious child processes spawned by cbssvcX64.exe. The attackers then pulled down Taskgmr.ps1, msedge.exe, edge.exe, config.json and WinRing0x64.sys from an Alibaba Cloud OSS bucket. edge.exe is XMRig renamed to look like Microsoft Edge. msedge.exe is a modified NSSM binary that keeps the miner running as a SYSTEM service named MicrosoftEdgeUpdateSvc, chosen to look like the legitimate Edge update service. The PowerShell script stops the miner while Task Manager is open, and the WinRing0 driver gives the miner kernel-level hardware access.

On affected versions, Huntress says AhsayCBS is vulnerable through 10.3.4 inclusive. Initial NVD data listed 10.3.4 as unaffected, and SecurityWeek's coverage cites versions through 10.3.2 as confirmed affected before noting Huntress's update. Neither Huntress nor SecurityWeek includes a statement from Ahsay.

Why it matters

SecurityWeek notes that AhsayCBS is popular with MSPs and system integrators. A backup management server holds copies of customer data and is trusted by the agents that report to it. An unauthenticated bypass that lands as SYSTEM on that host is a privileged path with no credential to steal, so MFA and password policy on the console don't help. The payload seen so far is a cryptominer, but the same access supports webshells and other persistence, and Huntress warns that attackers have been able to hide secondary backdoors.

Anyone who relied on the early NVD data to call 10.3.4 safe should revisit that call. With no fix, exposure reduction and hunting are the only controls available.

What to check in your environment

• Inventory every AhsayCBS server, including instances run for you by an MSP or backup provider. Treat every version up to and including 10.3.4 as vulnerable.
• Take the management interface off the internet. Huntress recommends limiting web access to trusted IP addresses or requiring a VPN until a patch ships.
• Review process telemetry for unexpected child processes of cbssvcX64.exe or cbssvcX86.exe, such as PowerShell, curl or certutil.exe.
• Check the replication receiver configuration for receivers you didn't create, and look for new JSP files in the AhsayCBS web application directory.
• Hunt for the persistence and payloads: a service named MicrosoftEdgeUpdateSvc on a backup server, Edge-named binaries outside the Edge install path, and these SHA256 hashes from Huntress: 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d (edge.exe), 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 (msedge.exe), 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 (Taskgmr.ps1).
• Block and search network logs for imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, the mining pool xmr.kryptex[.]network:8029, 51.195.127[.]124:8029, and the six source IPs in the Huntress IOC list.
• Re-image confirmed compromises. Huntress is blunt about cleanup:

  "Companies should carry out a full host re-image from a trusted backup; as attackers have been able to hide secondary backdoors for extended persistence" (Huntress)

• Rotate secrets stored on or used by a compromised backup server, and ask your MSP in writing whether its AhsayCBS console was exposed and what it has checked.

References

• Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• SecurityWeek: Unpatched AhsayCBS vulnerabilities exploited in the wild
• NVD: CVE-2026-105134 (description lists 10.3.4 as the fixed version)