Attackers chain two unpatched AhsayCBS flaws to drop webshells and crypto miners
The AhsayCBS backup platform used by MSPs is still exploitable through an authentication bypass and a command injection flaw, including in its latest 10.3.4 release. Restrict the admin console to trusted IPs and treat any anomaly as a compromise until proven otherwise.
7 October 2026. Managed detection and response firm Huntress observes attackers exploiting two unpatched vulnerabilities in the AhsayCBS backup platform across at least five organisations. 9 October 2026. Huntress confirms that version 10.3.4 — the latest available — remains affected, even though the vendor treated the flaws as fixed since 10.3.2. 9 October 2026. BleepingComputer relays the alert; Ahsay had not responded at publication time. Why it matters: AhsayCBS is the backup component that managed service providers run for their customers — a hole here cascades across an entire client portfolio.
Two flaws, and a fix that is not one
The two exploited flaws are documented. CVE-2026-105133 is an authentication bypass with a public exploit already circulating. CVE-2026-105134 enables OS command injection. Each is serious on its own; chained, they form a complete path — skip authentication, then run code.
The abnormal part is the patch status. Both vulnerabilities were announced as fixed in AhsayCBS 10.3.2. But Huntress checked for itself: 10.3.4, the current release, is still vulnerable. An administrator who applies the latest update assuming they are protected is not. That is the most dangerous configuration possible — a false sense of security supplied by the vendor.
The gap between a claimed fix and the on-the-ground reality is not a technical footnote. On a backup platform, the admin console concentrates the most sensitive functions: restore, scheduling, access to the repositories. Leaving it reachable by an unauthenticated attacker is handing over the keys to the disaster-recovery mechanism itself.
The attack chain observed in the wild
Huntress analysts reconstructed the full sequence. The attacker first uses CVE-2026-105133 to bypass authentication, then CVE-2026-105134 to execute code. Once inside, they proceed in measured steps.
They start with reconnaissance on the compromised host. They then drop JSP webshells (Java Server Pages) to keep a persistent, remote foothold. Finally they download the XMRig cryptocurrency miner, disguised as edge.exe — the name of the Microsoft Edge browser — so it blends into the noise of a legitimate Windows server.
The targeting is not random. Because AhsayCBS is the tool MSPs use to back up their clients’ machines, one successful compromise gives an attacker a foothold across several organisations at once. Five confirmed victims is a floor, not a ceiling: the real scope depends on how many instances are internet-exposed, a figure Huntress has not published.
Persistence built to fly under the radar
The most instructive part of the incident is not the exploitation but the persistence. The miner installs itself as a service named MicrosoftEdgeUpdateSvc, running msedge.exe — in reality a modified copy of the legitimate NSSM (Non-Sucking Service Manager) utility. The service name mimics the Edge updater, so an administrator scrolling the service list sees nothing out of place.
The stealth goes further. A PowerShell script named Taskgmr.ps1, which Huntress suspects was generated with AI assistance, orchestrates the camouflage. When Event Viewer or Task Manager opens, the script stops the mining service; when the window closes, it restarts it. It even kills Task Manager at 6 p.m. local time, or if it stays open for more than an hour overnight.
In at least one case the attacker also dropped the vulnerable WinRing0x64.sys driver, likely to unlock extra hardware resources for the miner. That driver, known to be exploitable for privilege escalation, worsens the compromise by opening another door into the kernel.
The AI-assisted script is the detail worth lingering on. Defenders have long relied on the rough edges of handwritten malware — awkward service names, obvious timers, clumsy self-concealment — to spot it quickly. A script that stops mining the moment Task Manager opens, and that targets a six-o’clock kill window, is the kind of adaptive behaviour that used to mark a patient, skilled operator. Today it can be produced by a language model on request. The implication is uncomfortable: the floor for evasive tradecraft has dropped, and the baseline a defender must assume — that any process on a compromised backup host is actively lying — has risen with it.
Backup is the organ attackers hit first
Why target a backup platform instead of a business server? Because backup is the resilience organ. An attacker who compromises the backup tool does not just gain data — they gain the ability to strike at the moment their victim most needs to recover.
The classic ransomware playbook shows why. Before encrypting a company’s files, the most methodical groups go after the backups first: they delete them, encrypt them or render them unusable. Without a clean backup, the victim is left with two options — pay the ransom or lose the data. A platform like AhsayCBS, which centralises the backups of several organisations at once, is therefore twice as profitable a target: it yields both the data and the negotiating leverage.
For an MSP the maths is even worse. The MSP runs AhsayCBS on behalf of its own clients. A compromise of the instance means the attacker reaches, through a single entry point, the perimeter of every backed-up client. That is the definition of a supply chain attack through trusted tooling.
There is a simple technical reason these incidents recur: backup admin consoles are historically exposed, often for convenience — a remote access path for support, a web console open to the internet. That is exactly what Huntress advises fixing first, before even hunting for indicators of compromise.
What MSPs should do right now
With no real patch available, the response is containment, not patching. Huntress gives clear instructions to follow without waiting for Ahsay.
- Restrict the admin console. Limit access to the AhsayCBS console to trusted IP addresses only — ideally through a VPN or a network allowlist. This single measure shrinks the attack surface the most.
- Hunt for compromise. Huntress has published indicators of compromise (IoCs) and four Sigma rules to detect the activity. Deploy them on your monitoring stack.
- Do not trust the version number. 10.3.4 is just as vulnerable as earlier releases. Until a verified fix ships, no update constitutes protection.
- Prepare for a full restore. If compromise is confirmed, Huntress recommends a complete restore of the host from a clean backup, because the attacker may have planted additional backdoors.
The reflex to avoid is “cleaning” the miner and moving on as if nothing happened. A miner is rarely the end of the story — it is often the first visible symptom of an older and deeper intrusion. Treat every backup host as a recovery asset first and a running service second: its integrity is worth more than its uptime.
Verdict
If you run AhsayCBS — directly or on behalf of clients as an MSP — treat the incident as a possible compromise today: cut console exposure, deploy the IoCs and Sigma rules, and prepare a restore plan. If you must choose between waiting for the patch and isolating the machine, isolate: a compromised backup platform is exactly what an attacker uses to destroy your recovery capability. If you are a customer of an MSP using AhsayCBS, ask for proof that your instance is out of reach — the vendor’s silence should not become yours.