AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server

What to do

1. Check the build in the AhsayCBS web console under System Settings > License > Update License (Product Version).
2. Apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9) from Ahsay's partner portal, then reboot the server.
3. Restrict the management web interface to trusted admin IPs or a VPN.
4. Hunt for compromise back to Oct 4, 2026: new JSP files, shells spawned by the AhsayCBS service, a fake MicrosoftEdgeUpdateSvc, and new OpenSSH installs.
5. If you find indicators, re-image the host from a trusted backup and rotate every credential stored on or used by the server.

How to check if you are affected or compromised

• Look for new or modified .jsp files in the AhsayCBS web application directories and .cmd or PowerShell files in C:\Users\Public.
• Alert on cmd.exe or powershell.exe launched by the AhsayCBS service, and on a MicrosoftEdgeUpdateSvc service running edge.exe or msedge.exe that is not Microsoft's.
• Check outbound traffic for 38.60.252.110 (reported by both Huntress and Bitdefender), xmr.kryptex.network:8029 and imagefiles-backup.oss-ap-southeast-7.aliyuncs.com.
• Review new services, scheduled tasks, accounts and privilege changes since Oct 4, 2026, and any OpenSSH server that appeared unexpectedly.

What happened#

AhsayCBS is the server and management console of Ahsay's backup platform. Huntress says it is used mainly by MSPs and system integrators to create users, set backup policies and run backup operations. On October 4, 2026, VulDB published two CVEs against it and noted that an exploit had been published:

• CVE-2026-105133 (CVE record, CWE-287): manipulating the random argument in the API's checkSysPwd function bypasses authentication. CVSS 3.1 7.3.
• CVE-2026-105134 (CVE record, CWE-78): the same argument is injected into OS commands at the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. CVSS 3.1 10.0.

Three days later the chain was in use. Huntress saw the first exploitation on October 7 at 23:20 UTC and had counted five targeted organizations by October 8. The attackers ran code as SYSTEM, set up a malicious replication receiver and dropped JSP webshells. They also installed an XMRig miner disguised as edge.exe, kept alive by a fake MicrosoftEdgeUpdateSvc service. Bitdefender's MDR team investigated three incidents involving webshells, PowerShell staged in C:\Users\Public, credential reconnaissance and an OpenSSH install via obfuscated PowerShell. It says "several different actors may be using the same exploits" and saw no encryption or exfiltration. CISA added both CVEs to KEV on October 14, with an October 17 deadline.

Who is affected#

The CVE records and NVD say AhsayCBS up to 10.3.2 is affected and 10.3.4 is not. That is no longer accurate. Huntress found on October 8 that 10.3.4 is also vulnerable. On October 12, Ahsay said its earlier patches, 10.3.4.0 and 9.15.2.59, did not fully address the flaws, and released partner-only hotfixes: 10.3.4.45 for v10 and 9.15.2.70 for v7, v8 and v9. Ahsay's 10.3.4 release notes (August 5, 2026) list no security fixes at all. Treat every build below those two hotfixes as vulnerable.

Do you really need to act?#

Only if an AhsayCBS server is yours or holds your data, and in that case, yes, today. The chain needs no credentials and gives SYSTEM on the machine that controls backup users, policies and operations for every customer it serves. Exploitation began within days of disclosure, more than one actor appears to be involved (CVE-2026-105133 is also in KEV), and many operators who installed 10.3.4.0 in good faith believed they were patched. Teams that only run endpoint backup clients against a provider's server have nothing to install, but they should ask the provider directly. Everyone else can ignore this one.

What to do now#

1. Confirm the build in the web console under System Settings > License > Update License (Product Version), as Bitdefender describes.
2. Download and apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9) from Ahsay's partner portal, then reboot, as Ahsay instructs. Huntress verified that 10.3.4.45 "mitigates the initial entry point."
3. Limit the management interface to trusted IPs or a VPN. Huntress and Bitdefender both recommend this, but it is not vendor guidance and not a substitute for patching.
4. Hunt from October 4 onward (next section). Patching does not remove webshells or other persistence.
5. If you find indicators, re-image from a trusted backup, as Huntress advises, and rotate credentials the server stores or uses.

How to tell if you were hit#

Look for new or changed .jsp files in the AhsayCBS web application directories, and cmd.exe or powershell.exe running as children of the AhsayCBS service. Other signs are a MicrosoftEdgeUpdateSvc service backed by edge.exe (XMRig) or msedge.exe (a modified NSSM), a Taskgmr.ps1 script, a downloaded WinRing0x64.sys driver, .cmd files in C:\Users\Public, and an OpenSSH server that was never there before. On the network, check for traffic to 38.60.252.110 (reported by both firms), xmr.kryptex.network:8029 and imagefiles-backup.oss-ap-southeast-7.aliyuncs.com. Bitdefender cautions that the reliable signal is "how the server behaves after the exploit fires," because static indicators change between actors.

Timeline#

• Aug 5, 2026 — AhsayCBS 10.3.4 is released.
• Oct 4, 2026 — CVE-2026-105133 and CVE-2026-105134 are published, with a public exploit noted.
• Oct 7, 2026 — Huntress sees the first exploitation at 23:20 UTC.
• Oct 8, 2026 — Huntress publishes its findings, then confirms that 10.3.4 is also affected.
• Oct 12, 2026 — Ahsay says the earlier patches were incomplete and releases hotfixes 10.3.4.45 and 9.15.2.70.
• Oct 14, 2026 — CISA adds both CVEs to KEV.
• Oct 15, 2026 — Bitdefender publishes its advisory, based on three incidents.

Vulnerability records

• CVE-2026-105133 · KEV 2026-10-14 · A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
• CVE-2026-105134 · KEV 2026-10-14 · A flaw has been found in Ahsay AhsayCBS up to 10.3.2.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Ahsay — (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134 ahsay.com
2. CVE record — CVE-2026-105133 cve.org
3. CVE record — CVE-2026-105134 cve.org
4. NVD — CVE-2026-105134 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-105133 cisa.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-105134 cisa.gov
7. Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer huntress.com
8. Bitdefender — Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134) bitdefender.com
9. Ahsay — AhsayCBS v10.3.4 release notes ahsay.com