Hackers are actively exploiting a pair of unpatched vulnerabilities in the widely used AhsayCBS backup solution to achieve remote code execution on target systems, according to a warning issued by cybersecurity firm Huntress.
The software at the center of the security advisory is AhsayCBS, a centralized cloud backup server management console developed by Ahsay Systems. The application provides essential administrative infrastructure for managed service providers (MSPs) and system integrators, handling backup policies, storage management, and user administration across client environments. Because these consoles typically hold privileged access to extensive organizational data, an effective compromise of an AhsayCBS server carries severe risks for both service providers and their downstream customers.
The two security defects are tracked as CVE-2026-105133 and CVE-2026-105134. According to vulnerability disclosures, these vulnerabilities allow malicious actors to manipulate arguments within specific functions of the backup administration tool. By doing so, attackers can successfully bypass authentication controls and inject arbitrary operating system commands directly into the underlying host environment.
The vulnerabilities first came to public attention on October 4, when the National Institute of Standards and Technology (NIST) issued an advisory warning that exploit code targeting the defects had been released into the wild. At the time of that initial disclosure, NIST indicated that all versions of AhsayCBS up to and including version 10.3.2 were affected by the flaws.
However, the threat landscape escalated rapidly. On Thursday, cybersecurity researchers at Huntress published a detailed advisory warning that threat actors had begun actively exploiting the two flaws in real-world attacks. Furthermore, Huntress reported that the vulnerability scope is broader than initially understood, confirming that the latest available version of the software, AhsayCBS version 10.3.4, is also vulnerable to exploitation.
Until an official security patch is released by the vendor to remediate the vulnerabilities, Huntress has strongly urged administrators to restrict external access to the management interface and immediately investigate their networks for any signs of unauthorized activity or compromise.
According to telemetry and analysis from Huntress, active threat actors are chaining the two vulnerabilities together to bypass perimeter defenses, access vulnerable enterprise systems, and execute arbitrary code. By October 8, investigators had identified at least five distinct organizations that had been targeted in these campaigns.
Huntress noted that threat actors have been exploiting the vulnerabilities specifically to gain unauthenticated remote code execution and subsequently deploy malicious webshells on exposed systems. This grants the attackers persistent, interactive access to the compromised server from the outside.
A closer look at the technical mechanics reveals that CVE-2026-105134 can be leveraged for unauthenticated remote code execution with high-level System privileges by interacting with an application programming interface (API) associated with the Replication Receiver component of AhsayCBS.
The API in question contains a critical authentication bypass flaw that allows a completely random token to be substituted in place of valid user credentials. Once this bypass is successfully executed, the threat actor configures a malicious receiver and drops a Java Server Page (JSP) webshell directly into the application directory served by the central CBS application, securing a foothold on the server.
Once initial access and a stable webshell have been established, the threat actors quickly move to consolidate their position through extensive reconnaissance and the deployment of secondary payloads. In the incidents analyzed by Huntress, the attackers deployed XMRig cryptominers designed to covertly mine digital currency at the expense of the host’s computing resources. To avoid immediate detection by administrators checking system activity, the cryptominers were cleverly disguised under the guise of Microsoft Edge binaries.
In addition to hiding the mining software, the attackers implemented advanced evasion techniques. They planted an AI-assisted PowerShell script specifically designed to monitor the Windows Task Manager. If the monitoring script detects that Task Manager remains open for too long—potentially exposing the resource-heavy cryptomining activity to an administrator—it automatically terminates the diagnostic tool.
The threat actors also secured long-term persistence on the compromised operating systems by creating a rogue Windows service. This service was configured to masquerade as the legitimate Microsoft Edge Update service, but it was actually utilized to execute a modified copy of the Non-Sucking Service Manager (NSSM) utility, renamed to msedge.exe and running with elevated System privileges.
NSSM is a legitimate software utility often used by administrators to manage Windows services and ensure that specific background programs continue running and automatically restart after a system crash or reboot. Huntress noted that the threat actors in this campaign likely leveraged NSSM to maintain continuous persistence for their malicious processes while masking the service-related binaries as legitimate-looking files to evade casual inspection.
In at least one observed attack vector, the hackers went a step further by deploying WinRing0x64.sys. This is a legitimate, third-party kernel driver that is known to contain vulnerabilities, which the attackers utilized to enable their cryptocurrency miner to operate with deep kernel-level access, bypassing standard user-mode security restrictions.
Given the severity of the active exploitation campaigns and the lack of an immediate software patch from the vendor, Huntress has issued clear defensive recommendations for organizations utilizing the platform. Security teams should immediately restrict external web access to the AhsayCBS management interface, as the exploit specifically targets the externally accessible web application service running on the host. Access to the management console should be strictly limited to trusted internal IP addresses or placed securely behind a corporate virtual private network (VPN).
