Affected Systems
Ahsay AhsayCBS backup utility, all versions including the latest 10.3.4. Two vulnerabilities: CVE-2026-105133 (CVSS v4 5.5, improper authentication) and CVE-2026-105134 (CVSS v4 9.3, OS command injection). Attackers chain both flaws to bypass authentication and execute arbitrary commands remotely.
Exploitation Status
Active exploitation confirmed since October 7, 2026. At least five organizations compromised as of October 8, 2026. No patch available; vendor-claimed fix in version 10.3.4 is ineffective, making these zero-day vulnerabilities.
Business Impact
Attackers gain full remote code execution on AhsayCBS hosts exposed to the internet. Post-compromise activity includes web shell deployment, XMRig cryptominer installation (disguised as edge.exe), reconnaissance, and kernel-level driver abuse (WinRing0x64.sys) for mining optimization. AI-assisted PowerShell scripts evade detection by monitoring and terminating Task Manager. Organizations with internet-facing AhsayCBS management interfaces are at immediate risk of compromise and cryptojacking.
Urgency
🔴 Immediate
Recommended Actions
- Immediately restrict AhsayCBS management interface access to trusted IP addresses only or place behind VPN; do not expose to the public internet.
- Hunt for indicators of compromise: web shells, edge.exe processes (XMRig miner), Taskgmr.ps1 PowerShell script, WinRing0x64.sys driver in TEMP folder, and certutil.exe usage for file downloads.
- Monitor outbound network connections from AhsayCBS hosts for cryptocurrency mining pool traffic and command-and-control activity.
- Review authentication logs for suspicious API access to com/ahsay/obs/api/ApiStructsAction.java and Replication Receiver component.
- Consider disabling or isolating AhsayCBS until vendor releases a verified patch addressing CVE-2026-105133 and CVE-2026-105134.