Attackers chain two AhsayCBS backup flaws to bypass authentication and deploy cryptominers disguised as Microsoft Edge

Huntress reported active exploitation of two flaws in the AhsayCBS backup platform beginning October 7. CVE-2026-105133, rated 5.5, is improper authentication in a password-check function, and CVE-2026-105134, rated 9.3, is OS command injection in the Replication Receiver component; chained, they let a remote attacker bypass authentication and run arbitrary commands. The vendor advisories list version 10.3.4 as the fix, but Huntress found that release is also vulnerable, so the issues are effectively zero-days with no patch available. Post-exploitation activity included web shells and XMRig cryptominers named edge.exe to impersonate the browser, managed by a PowerShell script that pauses mining when Task Manager opens.

Check

Restrict the AhsayCBS management web interface to trusted IPs or require VPN access, and hunt for web shells and edge.exe cryptominer processes since no effective patch exists.

Affected

Internet-facing AhsayCBS servers, including version 10.3.4, let a remote attacker chain two flaws to bypass authentication and execute commands, leading to web shells and cryptominers.

Fix

Limit access to the AhsayCBS interface to trusted networks, monitor for compromise indicators, remove miner payloads and web shells, and await a confirmed fixed release.