Attackers Exploit Unpatched AhsayCBS Flaws to Deploy Web Shells and Miners

Threat actors are actively exploiting two unpatched vulnerabilities in AhsayCBS backup software to gain unauthorized access to systems and deploy malicious payloads. According to reports from SecurityWeek and The Hacker News, attackers are leveraging these flaws to install web shells and XMRig cryptocurrency miners on affected devices.

The campaign involves the use of CVE-2026-105133 and CVE-2026-105134. These vulnerabilities enable attackers to bypass authentication mechanisms and inject operating system commands. Once access is gained, the threat actors deploy XMRig miners that are disguised as Microsoft Edge processes to evade detection. The inclusion of web shells provides persistent remote access to the compromised infrastructure.

Technical Details of the Vulnerabilities

The primary vulnerability driving this exploitation is CVE-2026-105133, which carries a CVSS v4 score of 5.5. According to The Hacker News, this is an improper authentication vulnerability located in the `checkSysPwd()` function within the `com/ahsay/obs/api/ApiStructsAction.java` file. This flaw allows attackers to bypass the authentication checks required to access sensitive API endpoints.

CVE-2026-105134 is also being exploited in conjunction with the first flaw. SecurityWeek notes that this second vulnerability allows for OS command injection. Together, these two flaws provide a complete attack chain: authentication bypass followed by arbitrary command execution. The combination allows for full system compromise without valid credentials.

Affected Systems and Impact

AhsayCBS is a backup utility used by organizations to manage data protection. The exploitation of these flaws puts backup infrastructure at risk, which can lead to data theft, ransomware deployment, or resource hijacking. The deployment of XMRig miners indicates that threat actors are leveraging compromised systems for cryptocurrency mining, which consumes computational resources and degrades system performance.

The use of web shells suggests that attackers are seeking long-term persistence within the network. This allows them to maintain access even if the initial exploitation vector is patched or blocked. The disguise of the miner as Microsoft Edge adds a layer of obfuscation, making it harder for security teams to identify the malicious process during routine monitoring.

What should you do?

Organizations using AhsayCBS should immediately verify if their systems are vulnerable to CVE-2026-105133 and CVE-2026-105134. Since no fix has been confirmed yet, administrators must monitor for signs of compromise. Look for unexpected processes, particularly those resembling Microsoft Edge but consuming high CPU resources. Audit API access logs for authentication bypass attempts and unusual command execution patterns.

What to do and how to stay safe: AhsayCBS

• Monitor system processes for XMRig miners disguised as legitimate applications like Microsoft Edge.
• Review API access logs for failed authentication attempts or unusual access patterns indicative of bypass.
• Check for the presence of unauthorized web shells on the AhsayCBS server.
• Isolate affected systems from the network to prevent lateral movement once compromise is detected.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the AhsayCBS vulnerabilities being exploited?

The vulnerabilities are identified as CVE-2026-105133 and CVE-2026-105134.

What is the CVSS score for CVE-2026-105133?

CVE-2026-105133 has a CVSS v4 score of 5.5.

What malicious software are attackers deploying via these flaws?

Attackers are deploying web shells and XMRig cryptocurrency miners disguised as Microsoft Edge.