Key points
- Attackers exploit CVE-2026-105133 and CVE-2026-105134 to gain system-level access.
- Huntress observed exploitation targeting at least five organisations in early October 2026.
- Version 10.3.4 remains vulnerable despite vendor claims of a fix in 10.3.2.
Threat actors are chaining two security flaws in the AhsayCBS management console to seize control of servers and deploy cryptocurrency miners. Researchers at Huntress reported observing these attacks on 7 October 2026, noting that the campaigns targeted at least five organisations by the following day. The attackers used the vulnerabilities to bypass authentication requirements and execute arbitrary commands on the host systems.
In plain English
The AhsayCBS platform is widely used by managed service providers to manage backup policies for their clients. The attack relies on a combination of two weaknesses: one that allows users to skip the login process and another that lets them run operating system commands. Together, these flaws give attackers full administrative control over the Windows server hosting the backup software.
The background
The exploited issues are tracked as CVE-2026-105133, a medium-severity authentication bypass, and CVE-2026-105134, a critical command injection flaw. While Ahsay stated that version 10.3.2 contained fixes, Huntress determined on 8 October 2026 that version 10.3.4 is also affected. This contradicts earlier guidance that listed 10.3.4 as a secure release.
What changes now
Attackers have been observed deploying Java Server Page webshells and the XMRig miner, disguised as a Microsoft Edge executable. They use a modified service manager to keep the miner running and a PowerShell script to hide activity from task managers. Huntress advises administrators to restrict access to the management interface and investigate signs of compromise immediately.
The attacker's path
Teams usually begin by identifying exposed management interfaces that lack network-level restrictions. In this scenario, the initial breach depends on an authentication bypass, allowing unauthorised entry without valid credentials. Once inside, the attacker escalates privileges through command injection, gaining high-level system access. This stage enables the deployment of persistent tools, such as webshells and miners, which maintain control even after reboots. Administrators should verify that management consoles are not accessible from public networks and monitor for unexpected service creations or hidden processes that consume significant resources.
What to do and how to stay safe: AhsayCBS
- Restrict access to the AhsayCBS management interface to trusted IP addresses only.
- Monitor system logs for unexpected service creations or modified system utilities.
- Investigate any signs of compromise by checking for unknown webshells or miners.
- Perform a full restore from a safe backup if a compromise is confirmed.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is version 10.3.4 of AhsayCBS safe from these vulnerabilities?
No, Huntress confirmed on 8 October 2026 that version 10.3.4 is also affected by the exploited flaws.
What vulnerabilities are being exploited in these attacks?
Attackers are chaining CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (command injection).
How many organisations were targeted in the observed campaign?
Huntress reported that at least five organisations were targeted as of 8 October 2026.
