AhsayCBS CVE-2026-105133 / CVE-2026-105134: Apply Hotfix and Hunt After Confirmed Exploitation

AhsayCBS is the centralised backup management console used by many managed service providers and system integrators. On 4 October 2026, NVD published CVE-2026-105133 (improper authentication) and CVE-2026-105134 (OS command injection in the Replication Receiver path). Public exploit material followed quickly.

What happened

Post-exploitation included JSP webshells, XMRig cryptominers masquerading as Microsoft Edge, a fake Edge Update service and, in at least one case, a vulnerable WinRing0 driver. NVD initially indicated a fix in 10.3.4; Huntress found that 10.3.4 remained vulnerable. Until the hotfix is applied and the host is checked for compromise, internet-facing AhsayCBS instances remain high priority.

What is affected

• Product: AhsayCBS (Cloud Backup Server) management console
• Versions: AhsayCBS v10 through 10.3.4.0, including builds previously described as fixed
• Fix: hotfix v10.3.4.45 from the Ahsay partner portal, with a reboot after install, per Ahsay’s 10 October 2026 announcement

CVE-2026-105133 is an improper authentication issue. CVE-2026-105134 is a critical command-injection issue in the Replication Receiver API that can yield SYSTEM-level execution when chained after the authentication bypass. Huntress observed the chain used for unauthenticated RCE on exposed consoles.

What to do, in order

1. Inventory. Find every AhsayCBS instance, including lab and DR. Note which management web interfaces are reachable from the internet or from untrusted networks. MSP-hosted shared consoles that manage many customers’ backups are the highest-impact targets.
2. Cut exposure immediately. Restrict the management interface to trusted admin IPs or require VPN. Do not leave the console on the public internet while you arrange the hotfix; Huntress recommends this until a complete fix is in place.
3. Apply the vendor hotfix. Partners on affected v10 builds should install AhsayCBS v10.3.4.45 from the Ahsay partner hotfix portal and reboot the server afterwards. Being on 10.3.4.0 is not enough; the vendor has stated that build did not fully remediate these CVEs.
4. Hunt for compromise before you trust the host. Patching does not remove webshells, miners or secondary backdoors. Review the Huntress guidance and IoCs, including:
   • Unexpected child processes from cbssvcX64.exe / cbssvcX86.exe
   • JSP files under the CBS web application directory that operators did not deploy
   • Service MicrosoftEdgeUpdateSvc or Edge-named binaries (edge.exe, msedge.exe) under Temp that are not legitimate Edge installs
   • PowerShell script Taskgmr.ps1 and related Task Manager–aware service control
   • Downloads of WinRing0x64.sys via certutil or curl from unexpected hosts
   • Connections to the miner pool endpoints listed in the Huntress write-up

   Huntress has published Sigma rules for this campaign in its threat-intel repository under 2026/2026-10/AhsayCBS_XMRig_Miner.

5. If compromise is confirmed. Re-image the host from a known-good backup rather than cleaning a webshelled backup console in place. Rotate credentials and API tokens the console could reach, check backup jobs and retention settings for tampering, and notify affected customers if an MSP shared console was hit.
6. Harden afterwards. Keep the management plane off the public internet, enforce MFA and least privilege for admin accounts, send logs off-box, and treat backup infrastructure as tier-0 for change control.

How authorised VAPT helps

Internet-exposed backup and RMM-adjacent consoles turn up repeatedly in external attack-surface reviews, often because a management UI was left open for vendor support or a temporary MSP workflow. An authorised external assessment confirms which AhsayCBS (and similar) consoles are reachable and whether management planes are segmented the way you think they are. PoCForge does not publish or use exploit code for these issues outside authorised engagements. See our testing methodology or get in touch.

Sources

• Huntress — “Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer” (8 Oct 2026)
• Ahsay — “Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134” (10 Oct 2026)
• BleepingComputer (9 Oct 2026)
• SecurityWeek (9 Oct 2026)
• The Hacker News (9 Oct 2026)
• CVE record — CVE-2026-105133
• CVE record — CVE-2026-105134