AhsayCBS CVE-2026-105133: Backup Console RCE Hits 5 Organizations, No Complete Patch

The exploit chain operates in three steps, all unauthenticated.

Step 1: Authentication bypass (CVE-2026-105133). The AhsayCBS web console uses a cookie-based session mechanism. CVE-2026-105133 allows an unauthenticated attacker to manipulate the session context in a way that bypasses the login requirement, reaching administrative console functionality without presenting valid credentials. Ahsay classifies the root cause as improper session validation in the management interface.

Step 2: Unauthenticated command injection (CVE-2026-105134). With authentication bypassed, the attacker targets the Replication Receiver configuration endpoint at /rps/api/json/UpdateReceivers.do. This endpoint in versions 10.3.4 and earlier passes attacker-controlled values to a system command without sufficient sanitization. The injection runs as SYSTEM, the highest privilege on a Windows host. CVSS 4.0 rates this component at 9.3 Critical; some sources cite 10.0 based on alternate scoring.

Step 3: Webshell and persistence. After achieving SYSTEM execution, the attacker drops a JSP webshell into the directory served by the CBS application. This provides persistent, authenticated-free command access that survives an AhsayCBS restart. In all five observed incidents, the threat actor then fetched additional payloads: Taskgmr.ps1, edge.exe (XMRig), msedge.exe (a modified NSSM service wrapper), config.json (mining pool credentials), and WinRing0x64.sys (a vulnerable kernel driver used by the miner). Payload staging occurred from an Alibaba Cloud OSS bucket at imagefiles-backup.oss-ap-southeast-7.aliyuncs.com.

The attack from initial HTTP request to running cryptominer takes minutes. Huntress observed certutil downloading WinRing0x64.sys as one of the first post-exploitation commands, indicating the attacker had a well-rehearsed playbook ready before the first exploitation event.

MITRE ATT&CK mapping: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059.001 (PowerShell execution via Taskgmr.ps1), T1036.005 (Masquerading as Edge), T1543.003 (Windows Service persistence as MicrosoftEdgeUpdateSvc), T1496 (Resource Hijacking via XMRig).

Huntress first saw exploitation at 23:20:15 UTC on October 7, 2026. By October 8 they had confirmed five targeted organizations. The threat actor appears to be scanning for internet-exposed AhsayCBS instances, then running the exploit chain in an automated or semi-automated sequence.

All five victim environments shared a common pattern: cbssvcX64.exe, the primary AhsayCBS service process, spawned cmd.exe or PowerShell as a child process. This process lineage is not part of normal AhsayCBS operation and is the primary detection indicator.

Post-compromise, network connections egressed to the Kryptex mining pool at xmr.kryptex.network on port 8029. Several source IPs from the active campaign are documented below. These IPs should be blocked at the perimeter; they are not associated with legitimate AhsayCBS or Ahsay infrastructure.

For organizations running cryptojacking detection tooling, the MicrosoftEdgeUpdateSvc service name and the WinRing0x64.sys driver are reliable indicators across multiple cryptominer families, not just this campaign.

These two rules target the specific process lineage and masquerading behavior observed in active AhsayCBS exploitation. Both carry experimental status; validate against your Windows event logging configuration before enabling automatic blocking.

The patch picture for AhsayCBS is unusual and warrants a direct explanation for teams trying to close this exposure.

Ahsay released version 10.3.4.0 on August 4, 2026, and said in release notes that it addressed CVE-2026-105133 and CVE-2026-105134. On October 9, following Huntress's disclosure of active exploitation, Ahsay initially reiterated that 10.3.4.0 was the fix. Huntress disagreed. After additional investigation, Huntress confirmed that all versions through 10.3.4 remain vulnerable to both CVEs. On October 10, Ahsay issued a follow-up statement acknowledging that v10.3.4.0 "did not fully address" either flaw.

A hotfix version, v10.3.4.45, has been referenced in limited secondary reporting as the complete fix. This hotfix requires a service restart after installation. As of October 12, this fix has not been independently confirmed by multiple sources. Before applying any version and declaring the exposure closed, verify directly with Ahsay Systems that the installed build closes both CVE-2026-105133 and CVE-2026-105134.

Neither CVE appears in CISA's Known Exploited Vulnerabilities catalog as of October 12. Active exploitation is confirmed regardless of KEV status. Teams should not wait for a KEV listing before acting.

Until a fully verified patch is confirmed, the most effective mitigation is network-layer access control: restrict the AhsayCBS management interface (default port 443 or the configured HTTPS port) to trusted internal IP ranges only. Any internet-exposed AhsayCBS instance running versions 10.3.4 or earlier should be treated as potentially compromised and investigated using the IOCs above before applying any configuration changes. As Huntress notes, upgrading a compromised server does not remove existing webshells or malicious configurations.

Apply these steps in order. Do not skip the compromise assessment (step 3) and proceed directly to patching if your AhsayCBS instance has been internet-exposed since October 7. Patching over a compromised system leaves backdoors in place.

Ransomware operators have a consistent operational priority: before encrypting production systems, they map and destroy the backups. A compromised backup management console inverts the entire recovery calculus. Instead of the attacker working against your backup, you are working against an attacker who already has a complete map of every system you can recover.

AhsayCBS is widely deployed by MSPs to manage backup for dozens or hundreds of client environments from a single console. A single compromised CBS instance exposes every client environment it manages. The attacker does not need to compromise each client individually. They browse the backup job list, identify the most critical systems, delete or corrupt those recovery points, and then deploy ransomware with confidence that recovery will be impossible or prohibitively expensive.

The MSP attack model here is particularly dangerous. The threat actor who deployed XMRig in October likely has the capability to pivot to ransomware. The cryptominer in the current campaign is financially motivated malware, not reconnaissance, but the same access that runs XMRig would run a ransomware encryptor. MSPs should assume that any AhsayCBS instance compromised in this campaign has given the attacker a complete inventory of every client's backup jobs, encryption keys, and cloud storage credentials.

The attack chain from unpatched AhsayCBS to full ransomware deployment against all MSP clients would be: initial access via CVE-2026-105133/105134, credential harvest from the CBS configuration database, lateral movement to client environments via backup agent credentials, backup deletion via the CBS admin console, and ransomware detonation. This entire chain is available from the same initial unauthenticated HTTP request that deploys XMRig today.

The current campaign uses cryptomining because it is profitable and low-risk. That calculus can change.