CVE-2026-105134: Critical AhsayCBS RCE Exploited to Deploy Webshells and Cryptominers

A backup server is supposed to be the system an organization trusts when everything else fails. But what happens when attackers compromise the backup management infrastructure before a recovery is ever needed?

That question became urgent in October 2026, when security researchers identified active exploitation of two vulnerabilities in AhsayCBS, a backup management platform widely used by managed service providers and organizations responsible for protecting business data.

The more severe issue, CVE-2026-105134, allows attackers to abuse the platform’s Replication Receiver functionality to achieve operating system command execution. When combined with an authentication weakness tracked as CVE-2026-105133, the vulnerabilities create a path from an exposed management interface to unauthenticated remote code execution.

This is not merely a theoretical exploit chain. According to Huntress’s investigation into the AhsayCBS attacks, malicious activity was observed beginning on October 7, 2026. Attackers deployed JSP webshells, launched reconnaissance activity, established persistence, and installed cryptocurrency miners disguised as legitimate Microsoft Edge components.

On October 12, Ahsay issued updated hotfixes after confirming that earlier patches had not completely addressed the vulnerabilities.

What Is CVE-2026-105134?

CVE-2026-105134 is a critical operating system command injection vulnerability affecting the Replication Receiver component of AhsayCBS.

The vulnerability involves the API endpoint /rps/api/json/UpdateReceivers.do. 에 따르면 National Vulnerability Database entry, insufficient handling of an argument named random can result in operating system command injection.

The vulnerability has been assigned a critical CVSS v4.0 score of 9.3 by its reporting authority, with a CVSS v3.1 score of 10.0 also reported by vulnerability databases.

속성	세부 정보
CVE	CVE-2026-105134
제품	AhsayCBS
취약한 구성 요소	Replication Receiver
엔드포인트	/rps/api/json/UpdateReceivers.do
취약성 등급	OS 명령어 주입
Related vulnerability	CVE-2026-105133, authentication bypass
심각도	중요
Observed exploitation	Yes, beginning October 7, 2026
Observed payloads	JSP webshells, XMRig miner, PowerShell scripts
Updated v10 hotfix	10.3.4.45
Updated v7–v9 hotfix	9.15.2.70

The relationship between the two vulnerabilities matters. CVE-2026-105133 weakens authentication, while CVE-2026-105134 provides the code execution capability. Huntress observed attackers combining them rather than treating the flaws as isolated issues.

How the AhsayCBS Attack Chain Works

The attack begins at the management interface of an internet-accessible AhsayCBS deployment.

Backup management applications often expose powerful administrative functionality. They may be able to configure storage locations, manage backup operations, modify replication settings, and coordinate restoration workflows.

A successful compromise of the management service can therefore give an attacker control over a particularly sensitive part of an organization’s infrastructure.

In the observed incidents, the attacker first exploited the authentication weakness associated with CVE-2026-105133. The resulting access made it possible to reach vulnerable Replication Receiver functionality.

The second vulnerability then allowed execution of commands on the underlying server.

Huntress reported execution occurring under the Windows NT AUTHORITY\SYSTEM security context. This is significant because SYSTEM-level execution provides powerful local privileges, potentially allowing the attacker to install services, manipulate files, and interfere with defensive controls.

The attackers subsequently configured a malicious replication receiver and dropped Java Server Page webshells into directories served by the AhsayCBS application.

This gave them a way to continue issuing commands through the compromised web application.

Rather than ending with initial access, the exploitation became the starting point for an operational intrusion.

What Huntress Observed During Real Attacks

The most revealing evidence came from the processes spawned by the AhsayCBS service.

Huntress observed suspicious command-line activity originating from cbssvcX64.exe, the executable associated with the backup service.

Normally, a backup management process is expected to carry out backup-related operations. When it begins launching unusual command interpreters or downloading executables into temporary directories, the process relationship becomes a valuable detection signal.

During these incidents, attackers used the compromised service to download additional payloads, including PowerShell scripts, executable files, configuration data, and a kernel driver.

The files were hosted on cloud object storage and written into temporary directories on victim systems.

Among the payloads were files named edge.exe, msedge.exe, Taskgmr.ps1및 config.json.

Those filenames were not accidental.

XMRig Disguised as Microsoft Edge

One of the most distinctive aspects of the campaign was the attempt to disguise cryptocurrency mining activity as legitimate browser-related processes.

Huntress identified edge.exe as an XMRig mining binary. XMRig is legitimate open-source mining software, but attackers frequently deploy it without authorization to consume a victim’s computing resources.

The attackers also deployed a modified version of the Non-Sucking Service Manager utility, or NSSM, under the filename msedge.exe.

NSSM can be used to run programs as Windows services and automatically restart them when they terminate. In this intrusion, the utility helped maintain the miner’s execution.

The attackers created a service named MicrosoftEdgeUpdateSvc, a name designed to resemble ordinary Microsoft Edge update infrastructure.

The service executed with SYSTEM privileges and supported the mining operation.

This approach served several purposes. It made the persistence mechanism look more familiar to administrators, allowed the payload to restart after interruptions, and reduced the chance that a casual review of running services would immediately reveal the intrusion.

Huntress observed the miner communicating with an XMR mining pool over port 8029.

The broader lesson is that process names alone are poor indicators of legitimacy. An executable called edge.exe running from a temporary directory and launched by a backup server service is not equivalent to a signed Microsoft Edge binary installed in its expected location.

A PowerShell Script Designed to Hide From Task Manager

The attackers also used a PowerShell script named Taskgmr.ps1 to manipulate the visibility of the mining operation.

According to Huntress, the script monitored whether Windows Task Manager was running.

When Task Manager opened, the script could stop the malicious service associated with the miner. When Task Manager closed, it could restart the service.

The script also contained logic to terminate Task Manager under certain time-based conditions.

This behavior is particularly revealing because it shows that the attacker anticipated manual investigation. The goal was not just to execute a payload, but to make suspicious resource consumption harder for an administrator to observe.

Huntress suggested that the script appeared AI-assisted based on characteristics of its commented code. That is an observation about the script’s appearance, not definitive proof that a particular AI model generated it.

The security implication does not depend on whether AI was involved. The important behavior is automated suppression of a user’s normal system inspection tools.

Detection and Indicators of Compromise

Organizations running AhsayCBS should investigate unusual child processes originating from cbssvcX64.exe 또는 cbssvcX86.exe, especially processes involving PowerShell, command interpreters, unexpected downloads, and new Windows services.

The following indicators were published in Huntress’s investigation.

Indicator	Significance
MicrosoftEdgeUpdateSvc	Suspicious service created for miner persistence
Taskgmr.ps1	Script that reacts to Task Manager activity
edge.exe in temporary directories	Observed miner masquerading as Edge
msedge.exe in temporary directories	Modified NSSM service wrapper
WinRing0x64.sys	Vulnerable driver observed in the campaign
xmr.kryptex[.]network:8029	Observed mining pool destination

Huntress also published these SHA-256 hashes:

edge.exe
4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d

msedge.exe
05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034

Taskgmr.ps1
481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21

These hashes identify files reported in the observed campaign. They should not be interpreted as an exhaustive list of every possible exploitation artifact.

Huntress has also released Sigma detection rules in its public threat intelligence repository. These focus on suspicious AhsayCBS child processes, deceptive Edge binaries, PowerShell behavior involving Task Manager, and downloads of the WinRing0 driver.

A strong investigation should correlate these signals rather than rely on a single filename.

Why Earlier Patch Information Is Misleading

One of the most important details in this incident is the difference between the original vulnerability records and the subsequent exploitation research.

The initial NVD description indicated that upgrading to AhsayCBS 10.3.4 could resolve the command injection problem.

However, Huntress later determined that version 10.3.4 remained vulnerable to the attack chain.

On October 12, Ahsay published an updated critical security announcement, explicitly confirming that previous patches, including v10.3.4.0 and v9.15.2.59, had not fully addressed the security issues.

The vendor now directs customers to the following hotfixes:

배포	Updated security hotfix
Affected AhsayCBS v10 deployments	10.3.4.45
Affected AhsayCBS v7, v8, and v9 deployments	9.15.2.70

Ahsay requires an authorized partner account to access the relevant hotfix downloads and instructs administrators to reboot the server after installation.

Huntress independently verified that v10.3.4.45 mitigates the initial entry point used in the observed attack chain.

This is an important distinction: blocking the observed entry point is not necessarily equivalent to independently demonstrating that every possible manifestation of the underlying command injection issue has been eliminated.

Administrators should therefore follow the vendor’s current remediation guidance rather than relying exclusively on older vulnerability database entries.

How Organizations Should Respond

Patch installation is the immediate priority, but a server that has already been exploited requires more than an update.

First, administrators should restrict access to the AhsayCBS management interface. Where possible, management traffic should be accessible only through a VPN or from explicitly trusted administrative networks.

Next, investigate whether the service has spawned unusual commands, created new services, or written executable files to temporary directories. Review relevant network traffic for the mining infrastructure and other suspicious outbound connections.

If indicators of compromise are identified, treat the server as potentially fully compromised.

Huntress recommends rebuilding affected hosts from trusted sources when compromise is confirmed, particularly because attackers may have established secondary persistence mechanisms that are not eliminated by removing the miner.

Backup infrastructure deserves special incident-response attention. Organizations should verify that their recovery copies remain trustworthy and that backup credentials, encryption-related secrets, and administrative access have not been exposed.

The compromise of a backup management server does not automatically prove that protected backup data has been stolen or destroyed. Nevertheless, it justifies examining the integrity and accessibility of the broader recovery environment.

Frequently Asked Questions

Is CVE-2026-105134 actively exploited?

Yes. Huntress documented real-world exploitation beginning October 7, 2026, and observed multiple affected organizations.

Is AhsayCBS 10.3.4 safe?

Version 10.3.4.0 alone should not be considered sufficient. Ahsay’s updated guidance requires the 10.3.4.45 hotfix for affected v10 deployments.

What is the relationship between CVE-2026-105133 and CVE-2026-105134?

CVE-2026-105133 is an authentication weakness. CVE-2026-105134 is a command injection vulnerability. Huntress observed attackers combining the weaknesses to obtain remote code execution without valid credentials.

Does installing the hotfix remove existing malware?

No. Applying a patch closes an attack path but does not automatically remove webshells, malicious services, or other persistence established during an earlier compromise.

최종 생각

The AhsayCBS incident demonstrates how quickly a vulnerability in infrastructure management software can become an operational compromise.

The observed attackers did not simply test whether commands could be executed. They deployed webshells, installed miners, disguised malicious processes as browser components, and developed mechanisms to frustrate basic system inspection.

For organizations responsible for business continuity, the most serious lesson is that backup infrastructure must be protected as carefully as the production systems it supports.

CVE-2026-105134 is not just a software patching issue. It is an active intrusion risk affecting the systems organizations depend on when they need to recover.