By Nana Muazin 
Cybersecurity researchers are issuing urgent warnings regarding active, in-the-wild exploitation targeting two severe, unpatched vulnerabilities affecting the AhsayCBS backup solution. Threat actors have begun chaining these security flaws to achieve unauthenticated remote code execution (RCE) on vulnerable systems, prompting security firms and industry observers to advise immediate defensive measures.
AhsayCBS functions as a centralized cloud backup server management console developed by Ahsay Systems. Widely deployed across managed service providers (MSPs) and system integrators, the platform provides critical infrastructure management capabilities, including backup policy configuration, centralized storage oversight, and comprehensive user administration. Because these systems typically hold extensive privileges and deep access to enterprise data environments, the emergence of active exploitation has raised significant security concerns across the managed services sector.
The vulnerabilities, officially tracked as CVE-2026-105133 and CVE-2026-105134, reside within the core architecture of the management platform. Specifically, the defects allow malicious actors to manipulate specific arguments within certain functions of the software. This manipulation effectively facilitates a complete bypass of authentication mechanisms and enables arbitrary operating system command injection.
Initial public disclosure of the defects occurred on October 4, when the National Institute of Standards and Technology (NIST) issued an advisory warning that proof-of-concept exploit code targeting the vulnerabilities had been released into the wild. At the time of that initial disclosure, official advisories indicated that all versions of AhsayCBS up to version 10.3.2 were susceptible to compromise. However, subsequent threat intelligence developments have revealed that the scope of the issue is even wider than initially understood.
On Thursday, cybersecurity firm Huntress published an updated threat advisory warning that attackers are actively exploiting the two flaws against exposed systems on the internet. Furthermore, Huntress confirmed that the threat extends beyond older iterations, noting that the latest AhsayCBS version, version 10.3.4, remains similarly affected by the vulnerabilities. In light of the ongoing attacks and the absence of an official software patch from the vendor, Huntress advised organizations running the platform to restrict access to the management interface immediately and begin comprehensive investigations for any indicators of compromise.
According to telemetry and analysis from Huntress, threat actors are actively chaining CVE-2026-105133 and CVE-2026-105134 together to penetrate target networks and execute arbitrary code with elevated privileges. As of October 8, investigators had identified at least five distinct organizations targeted in these coordinated attacks. Huntress observed threat actors leveraging the vulnerabilities to successfully achieve unauthenticated remote code execution and subsequently deploy malicious webshells on exposed systems.
Further technical analysis indicates that CVE-2026-105134 can be specifically exploited to achieve unauthenticated remote code execution running with full System privileges through an application programming interface (API) exposed by the Replication Receiver component of the backup software. The API contains an authentication bypass flaw that allows an attacker to substitute valid administrative credentials with a purely random token. Once this exploitation phase succeeds, the threat actor has been observed configuring a malicious receiver and dropping a Java Server Page (JSP) webshell directly into the application directory served by the CBS application framework.
Following the establishment of initial access through the deployed webshells, the threat actors executed a series of sophisticated post-exploitation activities designed to maximize their operational control and maintain long-term access. These activities began with internal reconnaissance of the compromised environment, followed by the deployment of XMRig cryptocurrency mining software. To avoid immediate detection by system administrators, the attackers carefully disguised the cryptomining executables to mimic legitimate Microsoft Edge processes.
In addition to deploying cryptominers, the malicious actors implemented aggressive defense-evasion tactics. They planted an AI-assisted PowerShell script specifically designed to monitor the Windows Task Manager. If the monitoring script detects that Task Manager has been left open for too long, it automatically terminates the utility, thereby preventing administrators from identifying unauthorized resource consumption or suspicious running processes.
To ensure persistence across system reboots and administrative interventions, the attackers established a covert foothold by creating a custom Windows service. This unauthorized service was configured to masquerade as the legitimate Microsoft Edge Update service. Instead of running routine browser update tasks, however, the service was structured to execute a modified copy of the legitimate Non-Sucking Service Manager (NSSM) utility, which the attackers renamed to msedge.exe and configured to run with high-privilege System privileges.
NSSM is a widely recognized service helper utility designed to manage other programs, ensuring that they remain continuously running and automatically restart following an application crash or system reboot. Huntress notes that the threat actors in this campaign likely utilized the utility to maintain reliable persistence for their malicious edge.exe processes, while skillfully disguising the service-related binary behind a benign, legitimate-sounding filename to evade casual inspection by defenders.
In at least one observed instance of the campaign, the hackers went a step further by deploying WinRing0x64.sys. This file is a legitimate but notoriously vulnerable kernel-level driver frequently abused in various security bypass scenarios. By loading this driver into the operating system, the attackers enabled their unauthorized cryptocurrency mining operations to execute with deep, kernel-level access, bypassing standard user-mode monitoring controls.
Given the active exploitation of these unpatched flaws and the sophisticated post-exploitation toolkits being deployed by threat actors, security researchers emphasize the critical need for immediate defensive hardening. Organizations utilizing the AhsayCBS backup solution are strongly advised to restrict access to the management interface web application immediately. Because the exploits specifically target the externally accessible web application service running on the host, administrators should strictly limit inbound connections to trusted, internal IP addresses or enforce mandatory Virtual Private Network (VPN) requirements until Ahsay Systems releases official security patches to resolve the underlying vulnerabilities.
Ali Ikhwan 
Asep Darmawan