AhsayCBS CVE-2026-105134: Backup Server Flaw Exploited

Last updated: 26 October 2026. Sources are listed at the end.

Attackers are exploiting an AhsayCBS vulnerability chain to take over backup servers run by managed service providers (MSPs). The two flaws, CVE-2026-105133 and CVE-2026-105134, were published on 4 October 2026. Huntress saw the first attack late on 7 October, and by 8 October it had counted five targeted organisations. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October.

AhsayCBS is the server side of Ahsay’s backup platform. MSPs, system integrators and backup resellers use it to host and manage backups for their clients. Ahsay is based in Singapore and claims more than 9,000 partners worldwide. So one compromised server can expose many customers at once.

There is also a trap in the patch history. Ahsay’s first fixes for the AhsayCBS vulnerability (10.3.4.0 and 9.15.2.59) did not fully close the hole. The working hotfixes are 10.3.4.45 for v10 and 9.15.2.70 for v7 to v9, released on 12 October.

The short answer

• Check your build number. Anything on v10 below 10.3.4.45, or v7 to v9 below 9.15.2.70, should be treated as vulnerable. That includes 10.3.4.0.
• Install the hotfix and reboot. Download it from the Ahsay partner portal. Ahsay says a reboot is required after applying it.
• Restrict access now. Limit the AhsayCBS management interface to trusted IP addresses or a VPN, as Huntress recommends.
• Hunt for compromise. The patch does not remove webshells or fake services. If you find any indicator, rebuild the host and rotate every credential it held.

What is the AhsayCBS vulnerability?

There are two bugs, and attackers chain them.

CVE-2026-105133 is an authentication bypass in the checkSysPwd function of the AhsayCBS API. In plain terms, the server can be tricked into accepting a random value instead of a real admin password. Its score depends on who you ask. OpenCVE shows a CVSS 4.0 score of 6.9, while Bitdefender and Field Effect quote 5.5.

CVE-2026-105134 is an OS command injection in the Replication Receiver component. The vulnerable endpoint is /rps/api/json/UpdateReceivers.do. Because the AhsayCBS service runs as SYSTEM on Windows, injected commands run with full control of the machine. The CVSS 3.1 score is 10.0, and the CVSS 4.0 score is listed as 9.3 or 10.0 depending on the source.

Huntress explains how the two fit together. The bypass gets the attacker past the password check, and the injection then runs their commands. As a result, anyone who can reach the web service can take over the server without a password. Ahsay’s hotfix closes the bypass, which in turn blocks the route to the injection.

Timeline: confirmed vs reported

Note one source conflict. The NVD entries say “up to 10.3.2” is affected and 10.3.4 is not. That is wrong in practice. Huntress showed 10.3.4 was exploitable, and Ahsay itself later confirmed the 10.3.4.0 patch was incomplete. Therefore, follow Ahsay’s advisory, not the NVD version range.

What attackers did after getting in

Huntress reported that attackers first set up a malicious replication receiver. Then they dropped JSP webshells into the folder the AhsayCBS web console serves. In other cases, the cbssvcX64.exe service was made to run curl and certutil to download a toolkit into a Temp folder.

The payload Huntress saw was a Monero cryptominer. XMRig was renamed edge.exe, and a modified NSSM service manager was renamed msedge.exe. Both ran under a new Windows service called MicrosoftEdgeUpdateSvc, which imitates Microsoft’s real Edge updater. In addition, a PowerShell script, Taskgmr.ps1, paused the miner whenever Task Manager was open. A vulnerable driver, WinRing0x64.sys, gave the miner kernel-level hardware access.

Bitdefender saw a different pattern in its own incidents. The attacker escalated an account to SYSTEM, searched for stored credentials and installed OpenSSH for persistence. The attacker also tried to stage .cmd files in C:\Users\Public. Meanwhile, neither Huntress nor Bitdefender reported encryption, data theft or ransomware in these cases.

Why a backup server is a ransomware prize

A cryptominer is a noisy, low-value use of this access. Still, do not take comfort in that. A backup server stores credentials for the machines it protects. It often has broad network reach, and it holds the copies you need to recover from ransomware.

That is why the AhsayCBS vulnerability matters beyond mining. An attacker who controls the server could delete or corrupt restore points before launching ransomware elsewhere. They could also steal client data straight from the backup sets. Both Huntress and Bitdefender say secondary backdoors were planted. For that reason, a miner today can become a ransomware foothold tomorrow, once access is sold on.

Am I affected?

Ahsay does not publish an exact list of affected builds. Its advisory refers only to “affected v10 versions” and “affected v7, v8 and v9 versions”. Therefore, the safe rule is simple: if you are below the hotfix build, assume you are exposed.

To check your build, Bitdefender points to the web console. Go to System Settings > License > Update License and read the Product Version. Compare all four parts of the number, because 10.3.4.0 and 10.3.4.45 look similar at a glance.

Next, check whether the web service is reachable from the internet. Run this from a network that should not have access, such as a mobile hotspot. Replace the host name with your own.

#!/bin/bash
# Run from a network that should NOT have access (e.g. a mobile hotspot)
host=backup.example.com
for port in 80 443; do
  if timeout 5 bash -c "</dev/tcp/$host/$port" 2>/dev/null; then
    echo "$host:$port is reachable"
  else
    echo "$host:$port closed or filtered"
  fi
done

How to fix the AhsayCBS vulnerability

1. Take a snapshot or disk image first. If the server was already hit, you will want evidence later.
2. Download the right hotfix from the partner portal: 10.3.4.45 for v10, or 9.15.2.70 for v7 to v9. Rescana reports that v7 and v8 servers must first move to v9.15.0.0, so confirm the upgrade path with Ahsay support.
3. Apply the hotfix and reboot, as Ahsay instructs.
4. Recheck the Product Version in the console after the reboot.
5. Restrict access. Huntress advises limiting the management interface to trusted IPs or a VPN.

There is a practical catch here. Ahsay’s network guide says ports 80 and 443 carry both the web console and client backup traffic. So you may not be able to close those ports if clients back up over the internet. In that case, consider a reverse proxy or firewall rule that only allows the /rps/ path from your known replication partners. This is our suggestion, not vendor guidance, so test it on a non-production server first.

Huntress independently confirmed that 10.3.4.45 blocks the initial entry point. However, we found no independent test of 9.15.2.70 yet.

How to check if the AhsayCBS vulnerability was used against you

Search back to 4 October 2026, because the flaws were public from that day. The commands below are read-only PowerShell, run as administrator on the AhsayCBS server. We parsed every snippet and ran the file checks against sample files.

First, look for the fake Edge service. A real Microsoft updater never runs from a Temp folder.

Get-CimInstance Win32_Service -Filter "Name='MicrosoftEdgeUpdateSvc'" |
  Select-Object Name, State, StartName, PathName

Then list anything currently running under the AhsayCBS service. Shells, PowerShell, curl or certutil here are red flags.

Get-CimInstance Win32_Process -Filter "Name LIKE 'cbssvcX%'" | ForEach-Object {
  Get-CimInstance Win32_Process -Filter "ParentProcessId=$($_.ProcessId)" |
    Select-Object Name, ProcessId, CommandLine
}

If process-creation auditing (event 4688) is on, you can also search history.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime='2026-10-04'} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'cbssvcX(64|86)\.exe' } |
  Select-Object TimeCreated, @{n='Detail'; e={ ($_.Message -split "`n" | Select-String 'New Process Name|Process Command Line') -join ' | ' }}

Malicious files and webshells

Next, hash the files Huntress named, using the SHA-256 values it published.

$bad = @{
  '05F69AE6B2B89C1C4DCF836BFF032232F11BF0109F2B498E2345045D06139034' = 'msedge.exe (modified NSSM)'
  '4DCB0202FE8B2D4D7B183764E38184CD6ED50132786CC7E7D1F7F4BCE1DD6F3D' = 'edge.exe (XMRig)'
  '481728A7C9C4C02BE07051D9C1958D902EA6397EBB8952AB83944818E3D25D21' = 'Taskgmr.ps1'
}
$dirs = @("$env:SystemRoot\Temp", "$env:SystemRoot\System32\config\systemprofile\AppData\Local\Temp")
$dirs += Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue |
  ForEach-Object { Join-Path $_.FullName 'AppData\Local\Temp' }
Get-ChildItem -Path $dirs -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -in 'edge.exe','msedge.exe','Taskgmr.ps1','config.json','WinRing0x64.sys' } |
  ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    [pscustomobject]@{ File = $_.FullName; Modified = $_.LastWriteTime; SHA256 = $h; Match = $bad[$h] }
  }

Any of those file names in a Temp folder deserves a look, even without a hash match. Also look for JSP files written since 4 October. Set $CbsHome to your install folder; the path below is only a placeholder. Expect some hits from the hotfix itself, so compare times with your patch date.

$CbsHome = 'C:\Program Files\AhsayCBS'   # change this to your AhsayCBS install folder
Get-ChildItem $CbsHome -Recurse -File -Filter *.jsp -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -ge [datetime]'2026-10-04' } |
  Sort-Object LastWriteTime | Select-Object LastWriteTime, FullName

Network and log checks

Finally, check live connections and the DNS cache against the IPs and domains published by Huntress and Bitdefender. Port 8029 is the mining pool port Huntress saw.

$iocIps = '177.4.12.11','38.60.252.110','107.191.47.199','185.220.236.49','104.234.26.10',
          '123.202.208.37','51.195.127.124','13.143.164.15','45.142.141.160','74.208.22.238','167.148.88.236'
Get-NetTCPConnection -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -eq 8029 -or $iocIps -contains $_.RemoteAddress } |
  Select-Object LocalPort, RemoteAddress, RemotePort, State, OwningProcess
Get-DnsClientCache -ErrorAction SilentlyContinue |
  Where-Object { $_.Entry -match 'kryptex|imagefiles-backup|captcha-eyw' } |
  Select-Object Entry, Data

You can run the same search over exported firewall or proxy logs on a Linux box.

grep -rEn '177\.4\.12\.11|38\.60\.252\.110|107\.191\.47\.199|185\.220\.236\.49|104\.234\.26\.10|123\.202\.208\.37|51\.195\.127\.124|13\.143\.164\.15|45\.142\.141\.160|74\.208\.22\.238|167\.148\.88\.236|kryptex|imagefiles-backup\.oss|captcha-eyw|:8029' ./firewall-logs/

Also review the replication receivers listed in the console. A receiver you did not create is a strong sign of this attack. Then check for new admin accounts, new services, scheduled tasks and unexpected OpenSSH installs. Bitdefender warns that its IOC list is not complete, so behaviour matters more than any single IP.

If you find signs of compromise

Huntress advises rebuilding the host from a trusted backup, because attackers planted secondary backdoors. Image the disk before you wipe it. Then rotate credentials, as Bitdefender lists: AhsayCBS admin accounts, storage destination keys, service accounts and any domain credentials cached on the host.

In addition, verify your backups. Run test restores of key client sets, and confirm that retention and restore points were not changed. If you keep an offline or immutable copy, compare it with the live data.

The India angle

We could not find figures for AhsayCBS installations in India, and we found no CERT-In advisory on this AhsayCBS vulnerability so far. Ahsay is headquartered in Singapore, and its own site features partners in Asia such as Vietnam. So if your company resells or runs Ahsay-based backup services, check now.

If your organisation falls under CERT-In’s April 2022 Directions, a confirmed compromise must be reported to CERT-In within 6 hours of noticing it. A backup server holding client data may also matter under the DPDP Act. However, the Rule 7 breach-notice duty to the Data Protection Board only applies from May 2027, so it is not in force yet. MSPs should still tell affected clients promptly, because their contracts may require it.

Quick checklist

• ☐ Find every AhsayCBS server, including DR, test and replication targets
• ☐ Read the four-part Product Version in System Settings > License
• ☐ Install 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9), then reboot
• ☐ Limit the management interface to trusted IPs or VPN
• ☐ Check for MicrosoftEdgeUpdateSvc, WinRing0x64.sys and odd files in Temp folders
• ☐ Look for new JSP files, unknown replication receivers and new admin accounts
• ☐ Search firewall and DNS logs for the published IPs and domains
• ☐ If compromised: image, rebuild, rotate all credentials, test restores
• ☐ Report to CERT-In within 6 hours if the Directions apply to you

The AhsayCBS vulnerability is a reminder that backup servers need the same hardening as any internet-facing system. If you want an outside view, our VAPT services can test your exposed backup and remote-access consoles. For a similar case of a trusted MSP tool under attack, read our post on the Arista VeloCloud Orchestrator exploitation.

Sources

• Huntress: Threat actors exploit critical AhsayCBS flaws to drop webshells and XMRig
• Ahsay: (Update) Critical Security Alert for CVE-2026-105133 and CVE-2026-105134
• Ahsay: Critical Security Alert (10 October 2026)
• Bitdefender: Technical advisory on the AhsayCBS exploitation chain
• OpenCVE: CVE-2026-105134
• OpenCVE: CVE-2026-105133
• The Hacker News: AhsayCBS flaws get new fixes after incomplete patches
• Ahsay: AhsayCBS network and firewall settings

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.