Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Vulnerabilities

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

October 9, 2026 (6:23 AM ET)

+ Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Unpatched AhsayCBS Vulnerabilities Exploited in the Wild https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) [+ Whatsapp](whatsapp://send?text=Unpatched AhsayCBS Vulnerabilities Exploited in the Wild https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) + Email

Software security

Hackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.

A centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.

Tracked as CVE-2026-105133 and CVE-2026-105134 , the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.

They were disclosed on October 4, when NIST warned that exploit code targeting them had been released, and that all AhsayCBS versions up to 10.3.2 were affected.

On Thursday, Huntress warned that attackers have exploited the two flaws in the wild and that the latest AhsayCBS version, 10.3.4, is also affected.

“Until a patch is available, we recommend restricting access to the management interface and investigating for signs of compromise,” Huntress says.

Advertisement. Scroll to continue reading.

According to Huntress, threat actors are chaining the two bugs to access vulnerable systems and execute arbitrary code on them. As of October 8, at least five organizations had been targeted.

“Huntress observed threat actors exploiting the vulnerabilities to gain unauthenticated remote code execution and deploy webshells on exposed systems,” the cybersecurity firm notes.

It also warns that CVE-2026-105134 can be exploited for unauthenticated RCE with System privileges through an API of the Replication Receiver component.

“The API contains an authentication bypass that could allow for a random token to substitute valid credentials. After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application,” Huntress explains.

After gaining initial access, the attackers conducted reconnaissance and deployed XMRig cryptominers disguised as Microsoft Edge. They also planted an AI-assisted PowerShell script to monitor Task Manager and terminate it if it remains open for too long.

They also achieved persistence by creating a Windows service masquerading as Microsoft Edge Update to execute a modified copy of the legitimate NSSM utility named msedge.exe with System privileges.

“NSSM can support other programs to ensure they stay running and restart after a crash or reboot, and threat actors in this incident likely used it to maintain persistence for edge.exe, while disguising the service-related binary as a legitimate-looking file,” Huntress notes.

In one attack, the hackers deployed WinRing0x64.sys, a legitimate but vulnerable kernel driver that enabled the cryptocurrency miner to operate with kernel-level access.

“Organizations should restrict AhsayCBS management interface web access, as the exploit targets the externally accessible web app service on the host. Access should be limited to trusted IP addresses only or require VPN,” Huntress recommends.

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

Written By

Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Latest News

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?

October 14, 2026

Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.

## Virtual Event: Zero Trust & Identity Strategies Summit 2026

October 14, 2026

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

People on the Move

Rapid7 has named Rik Ferguson as VP of Security Intelligence.

Cytactic has appointed Tim Brown as CSO.

Scott Simkin has joined Vega as CMO.

More People On The Move

Expert Insights

## AI Has Changed Attack Speed, Not Security Fundamentals

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

## Four Cyber Threats Harboring Big Plans for the Future

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

## Begin at the End: How to Enable Agentic Remediation

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

## “We Think the Security Control Is Working” Is No Longer Good Enough

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

## This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild illustration

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

+ Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Unpatched AhsayCBS Vulnerabilities Exploited in the Wild https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) [+ Whatsapp](whatsapp://send?text=Unpatched AhsayCBS Vulnerabilities Exploited in the Wild https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) + Email

Security Community

Stay Intouch

About SecurityWeek

News Tips

Got a confidential news tip? We want to hear from you.

Submit Tip

Advertising

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Vulnerabilities