Huntress says attackers are chaining two AhsayCBS flaws to get code execution on the backup console, then dropping webshells and a Monero miner. The company first saw exploitation on October 7 and had counted five targeted organizations by October 8.
The bugs. CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function, rated medium (CVSS v4 5.5). CVE-2026-105134 is an OS command injection in the Replication Receiver component, rated critical (CVSS v4 9.3). Per Huntress, the attackers use the first to bypass authentication and the second to run commands.
What the attackers do next. After access they run reconnaissance and deploy Java Server Page (JSP) webshells. They then download XMRig, disguised as edge.exe, and persist it as a service named MicrosoftEdgeUpdateSvc. A PowerShell script, Taskgmr.ps1, stops the miner service when Task Manager opens and restarts it when Task Manager closes.
Why it matters. A backup console sits close to the data an intruder wants most. A miner is the noisy, low-value payload here. The same foothold gives access to backup data and credentials, and webshells survive after the miner is removed.
Patch status is unclear. Reporting from BleepingComputer and SecurityWeek says the flaws were unpatched when exploitation began. The vendor fix is cited as version 10.3.2, but Huntress says 10.3.4 is also affected. Treat any update as provisional and verify with the vendor.
Recommended actions:
- Restrict access to the AhsayCBS management interface. Remove it from the public internet and allow only a management network or VPN.
- Hunt for a service named MicrosoftEdgeUpdateSvc, an edge.exe binary outside normal Edge paths, and Taskgmr.ps1.
- Search the AhsayCBS web directories for unexpected JSP files.
- Review outbound connections from the host for mining pool traffic.
- If you find a webshell, treat the server as compromised. Rotate credentials stored on or reachable from it, and check backup integrity.
Sources: Huntress, BleepingComputer, SecurityWeek, The Hacker News.
