Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Security firm Huntress reports that threat actors are actively abusing two unpatched security flaws in Ahsay Systems' AhsayCBS backup management console to achieve remote code execution. The bugs, CVE-2026-105133 and CVE-2026-105134, let attackers tamper with function parameters to sidestep authentication and inject operating-system commands; they were first flagged on October 4 alongside public exploit code, initially affecting all builds up to 10.3.2, though Huntress confirms the newest release, 10.3.4, is also vulnerable. The firm says intruders are combining both flaws—exploiting an authentication-bypass weakness in the Replication Receiver API tied to CVE-2026-105134—to drop JSP webshells, deploy disguised XMRig cryptominers, and set up persistence via a fake Microsoft Edge Update service, with at least five organizations hit by October 8. Since no fix exists yet, Ahsay customers are urged to lock down access to the AhsayCBS management interface, limiting it to trusted IPs or VPN connections, and to check for intrusion indicators.