Unpatched AhsayCBS Flaws Exploited to Deploy Webshells, Mine Crypto

AhsayCBS Version 10.3.4 Confirmed Vulnerable to Exploits Using AI-Assisted Evasion Scripts

Managed Service Providers (MSPs) and enterprises using AhsayCBS backup management servers are facing active exploitation of two unpatched vulnerabilities t

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Acknowledgements: Special thanks to Dipo Rodipe, John Hammond, Susannah Matt, Ben Nahorney, and Lindsey Welch for their contributions to this investigation and writeup. Update 10/8/26 @ 6pm ETAfter further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities. Previous reporting indicated that 10.3.4 was not susceptible; we have updated this writeup to

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.