AhsayCBS: two unpatched flaws under attack, and 10.3.4 won't save you

On 9 October 2026, Bleeping Computer reported active exploitation of two vulnerabilities in AhsayCBS, a backup management platform. The attacks were reportedly spotted on 7 October by Huntress, a managed detection and response company, and hit at least five organisations. For now, all of this rests on a single source, which is itself relaying Huntress’s findings, so treat the details as reported rather than confirmed. Bleeping Computer says it asked the vendor about its patching plans and had not heard back by publication time.

Two flaws chained together, and an update that doesn’t help

The first, CVE-2026-105133, is an authentication bypass, and a public exploit for it already exists. The second, CVE-2026-105134, allows operating system command injection. According to Huntress, the attacker chains them: the first gets them in without credentials, the second lets them run code on the server. One opens the door, the other hands over the keys to the building.

The worrying part is the version numbers. Both flaws were described as fixed in AhsayCBS 10.3.2. Yet in an update published on 9 October, Huntress says version 10.3.4, the most recent one at that date, is vulnerable too. So a fully updated server would still be exposed, and you can’t count on updating as your protection here. Usually “have you tried updating it?” is the answer. This time it isn’t.

What the attacker does once inside

Based on Huntress’s observations, the intrusion follows a recognisable pattern. The attacker starts with reconnaissance. Next come webshells in JSP (Java Server Pages) format, which give them remote access to the server. Finally, they download the XMRig miner, disguised as edge.exe.

Persistence relies on a service called MicrosoftEdgeUpdateSvc, which launches an executable named msedge.exe. Huntress identifies it as a modified copy of NSSM (Non-Sucking Service Manager), a legitimate service management utility. If you were wondering why your browser had suddenly become so hungry, the answer is that it isn’t your browser. A PowerShell script, Taskgmr.ps1, which Huntress believes was written with help from an AI, hides the mining: it stops the service when Task Manager opens and restarts it when Task Manager closes. Think of a child who only behaves while a parent is in the room. It also closes Task Manager at 6 pm local time, or if it stays open for more than an hour during the night. In one case, the attacker also installed the vulnerable WinRing0x64.sys driver, probably to give the miner wider access to the hardware.

Why a compromised backup server is a serious problem

AhsayCBS is mainly used by managed service providers and integrators. A server like this doesn’t just hold its operator’s data: it often holds all of its customers’ backups in one place. Mining is the only activity observed so far, but a webshell grants access that is in no way limited to mining. Huntress also thinks the attacker may have installed other backdoors to stay on the machines long term. Today’s freeloader running up your electricity bill could be tomorrow’s burglar going through your clients’ files.

What to do until a patch arrives

Until an effective patch is available, Huntress recommends that you:

• restrict access to the AhsayCBS admin interface to trusted IP addresses only;
• hunt for signs of compromise, using the indicators of compromise and the four Sigma rules published by Huntress;
• check for the items described above: a MicrosoftEdgeUpdateSvc service, edge.exe, msedge.exe or Taskgmr.ps1 files in unusual locations, the WinRing0x64.sys driver, and unknown JSP files;
• if a compromise is confirmed, fully restore the server from a clean backup. Removing the miner isn’t enough, since other backdoors may have been installed.

For a backup platform, the advice is simple: until the vendor delivers, your best defence is an admin interface the outside world can’t reach.