Hackers have exploited two unpatched vulnerabilities in the AhsayCBS remote code execution (RCE) backup solution, cybersecurity firm Huntress warns.
AhsayCBS is a centralized cloud backup server management console developed by Ahsay Systems. It offers backup policies, storage and user management and is popular with MSPs and system integrators.
Tracked as CVE-2026-105133 And CVE-2026-105134The exploited vulnerabilities allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject operating system commands.
They were announced on October 4, when NIST warned that exploit code targeting them had been released and that all AhsayCBS versions up to 10.3.2 were affected.
On Thursday, Huntress warned that attackers have exploited the two vulnerabilities in the wild and that the latest AhsayCBS version, 10.3.4, is also affected.
“Until a patch is available, we recommend restricting access to the management interface and checking for signs of compromise,” says Huntress.
According to Huntress, threat actors are concatenating the two flaws to access vulnerable systems and execute arbitrary code on them. As of October 8, at least five organizations had been targeted.
“Huntress observed threat actors exploiting the vulnerabilities to achieve unauthenticated remote code execution and deploy webshells to exposed systems,” the cybersecurity company notes.
It also warns that CVE-2026-105134 can be exploited for unauthenticated RCE with system privileges via an API of the Replication Receiver component.
“The API contains an authentication bypass that could allow a random token to replace valid credentials. Once exploited, a threat actor configured a malicious recipient and placed a Java Server Page (JSP) webshell in the application directory provided by the CBS application,” explains Huntress.
After gaining initial access, the attackers conducted reconnaissance and deployed XMRig cryptominers disguised as Microsoft Edge. They also injected an AI-powered PowerShell script to monitor Task Manager and terminate it if it stays open for too long.
They also achieved persistence by creating a Windows service masquerading as Microsoft Edge Update to run a modified copy of the legitimate NSSM utility called msedge.exe with system privileges.
“NSSM can support other programs to ensure they continue to run and restart after a crash or reboot. The threat actors in this incident likely used it to maintain the persistence of edge.exe while disguising the service-related binary as a legitimate-looking file,” notes Huntress.
In one attack, the hackers deployed WinRing0x64.sys, a legitimate but vulnerable kernel driver that allowed the cryptocurrency miner to operate with kernel-level access.
“Organizations should restrict web access to the AhsayCBS management interface as the exploit targets the externally accessible web app service on the host. Access should only be limited to trusted IP addresses or require a VPN,” Huntress recommends.
Related: Citrix urges immediate patching of critical NetScaler vulnerability
Related: Google Pixel 10 exploits netted hackers at Pwn2Own $560,000
Related: Cisco fixes a dozen critical security vulnerabilities
Related: Attackers target critical Atlassian vulnerability within hours of PoC publication
