CVE-2026-105134: AhsayCBS Backup Servers Fall to an XMRig Miner — and the 10.3.4 "Fix" Was No Fix

What Happened

On the host you can least afford to lose, foreign code has been running with the highest privileges since 7 October 2026: AhsayCBS, the central backup-management console from Ahsay Systems, is under active attack. AhsayCBS is the server frontend that managed service providers and system integrators use to steer backups for their customers — users, policies, storage, replication. If this console falls, it isn't one workload that falls, but the recovery layer for everything it manages.

Two vulnerabilities are being chained:

Both are reachable over the network without credentials, and for both there was public exploit code at the time of disclosure. In both cases the random argument is manipulated: with 105133, an arbitrary token replaces valid authentication; with 105134, the same manipulation leads to command execution in the context of NT AUTHORITY\SYSTEM.

The attack path in short: first 105133 to bypass login, then 105134 to configure a malicious Replication Receiver and drop a JSP webshell into the directory served by the application. From there, commands run as SYSTEM.

Post-Exploitation: A Miner in Edge Clothing

Huntress documents activity from 7 October 2026, 23:20:15 UTC and had at least five organizations in its own telemetry by 8 October. The observed chain:

• Webshell first: immediately after exploitation, a .jsp webshell lands in the webapp directory.
• Payload resupply: cbssvcX64.exe launches curl and certutil commands and pulls files from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com — Taskgmr.ps1, msedge.exe, edge.exe, config.json.
• XMRig as edge.exe: a Monero miner, renamed to a Microsoft Edge process name, connects to xmr.kryptex[.]network:8029 (worker krxYMRN97D/creativejs, plus 51.195.127[.]124:8029).
• Persistence as MicrosoftEdgeUpdateSvc: a Windows service modelled on the real edgeupdate service that runs msedge.exe with SYSTEM rights — in reality a modified copy of the legitimate NSSM utility.
• Taskgmr.ps1: a PowerShell script that Huntress calls AI-assisted, with anti-analysis behaviour. It monitors Task Manager, stops the mining service while Task Manager is open, and restarts it afterwards. It also kills Task Manager at 18:00 local time and if it stays open for more than an hour at night.
• Kernel access: in one case, certutil.exe fetches the legitimate but vulnerable driver WinRing0x64.sys so the miner can reach the hardware with kernel privileges.

Huntress published four Sigma rules and an IOC list; in none of the cases did the miner run as ransomware. But SYSTEM on the host that holds an MSP's backup catalogs is a compromise of the restore layer even without encryption.

The Patch That Wasn't

The real lesson here is the version chronology — a textbook case of why "fixed according to the advisory" does not mean "not vulnerable":

• 4 Oct 2026: NVD publishes both CVEs (CNA: VulDB). Both records name 10.3.0–10.3.2 as affected and 10.3.4 as not affected.
• 7 Oct 2026, 23:20 UTC: Huntress sees the first exploitation in the wild.
• 8 Oct 2026, 18:00 ET: Huntress corrects itself: 10.3.4 is also vulnerable — the version previously treated as the fix. Huntress informs the vendor.
• 9 Oct 2026: Ahsay states that v10.3.4.0 (released 4 August) had "addressed" both CVEs; updated partners were "no longer affected".
• 10 Oct 2026: Ahsay publishes a Critical Security Alert and retracts the claim: "our previous patch v10.3.4.0 did not fully address" both vulnerabilities. The fix now named is the partner-exclusive hotfix v10.3.4.45, followed by a reboot.
• 11 Oct 2026: Huntress and NVD records remain out of step; NVD still lists 10.3.4 as "unaffected". CISA KEV contains neither CVE, and the SSVC profile of the NVD records (as of 5 October) still says exploitation: none — two days before the first Huntress sighting.

Affected products: AhsayCBS up to and including 10.3.4 (the current release line); per the CNA, also older 10.1.x and 9.x builds. The hotfix sits behind the partner portal — there is no public ISO and no public checksum.

What Admins Must Do Now

1. Take the management interface off the internet. An exposed AhsayCBS is the complete precondition for the attack. Restrict access to trusted source IPs or put it behind a VPN — that is the only control that works regardless of patch status.
2. As an Ahsay partner: apply hotfix v10.3.4.45 from the partner portal and reboot — the reboot is explicitly required in Ahsay's notice. 10.3.4.0 alone no longer counts as closed.
3. Back up before updating: copy CBS logs and snapshots off-box before the maintenance window starts.
4. Hunt for compromise, not just patch. Indicators: unexpected child processes of cbssvcX64.exe/cbssvcX86.exe, the MicrosoftEdgeUpdateSvc service, edge.exe/msedge.exe in %TEMP%, Taskgmr.ps1, WinRing0x64.sys, outbound connections to port 8029. Anyone finding IOCs should rebuild the host entirely rather than "kill the miner and keep CBS" — according to Huntress, attackers hide secondary backdoors.
5. Check the restore path. If the compromised host is the backup platform, the standard advice to "restore from a clean backup" is circular. The clean state must demonstrably predate 7 October.

The case is therefore a double wake-up call: first about the attack surface of backup infrastructure — it belongs at the same isolation and monitoring level as a domain controller — and second about the half-life of vendor fix statements. The CVE records said "upgrade to 10.3.4", Huntress said "10.3.4 is in", and only the vendor confirmed two days later that the patch was incomplete. Whoever closes the ticket after the advisory closes it too early.

Sources

• Huntress – Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• Ahsay – Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134 (10 October 2026)
• NVD – CVE-2026-105134
• NVD – CVE-2026-105133
• CVE.org – CVE-2026-105134
• BleepingComputer – Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
• SecurityWeek – Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
• The Hacker News – Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
• Field Effect – Threat actors exploit AhsayCBS zero-days
• Ahsay – Release Notes AhsayCBS v10.3.4
• Huntress Threat Intel – Sigma rules and IOCs (GitHub)