AhsayCBS Breaches: Hackers Bypass Auth to Plant Web Shells, Run Commands & Disguised Miners on Backup Servers

Managed service providers must immediately assess their AhsayCBS backup infrastructure for signs of compromise. Threat actors are actively exploiting two recently disclosed vulnerabilities to seize control of servers, inject operating system commands, and deploy persistent backdoors. The exploitation campaign targets the authentication mechanisms of the backup utility, allowing unauthorized remote access without valid credentials.

How it unfolded

• SecurityWeek reported that unpatched AhsayCBS vulnerabilities are currently being exploited in the wild by threat actors.
• The Hacker News detailed that attackers are using these flaws to deploy XMRig cryptocurrency miners disguised as Microsoft Edge.
• The campaign involves installing web shells on affected devices to maintain persistent access and execute commands.

Who is affected

Organizations relying on AhsayCBS for data backup are at direct risk. The flaws, identified as CVE-2026-105133 and CVE-2026-105134, compromise the integrity of the backup environment. CVE-2026-105133, which carries a CVSS v4 score of 5.5, stems from an improper authentication vulnerability within the checkSysPwd() function. This specific flaw exists in the "com/ahsay/obs/api/ApiStructsAction.java" component of the software.

The second vulnerability, CVE-2026-105134, works in tandem with the first to enable full authentication bypass. Together, these issues allow attackers to inject operating system commands directly into the server. This level of access enables the deployment of web shells, which provide a persistent interface for further malicious activity. The combination of remote code execution and credential bypass creates a high-risk scenario for any exposed instance.

Our take on the response

The current threat landscape shows active exploitation of these specific AhsayCBS flaws. The use of disguised cryptocurrency miners, specifically XMRig masquerading as Microsoft Edge, indicates a sophisticated evasion technique. This disguise makes detection more difficult for standard monitoring tools that may overlook familiar process names. The presence of web shells further complicates remediation, as attackers can re-establish access even if the initial vulnerability is patched.

No confirmed fix or patch has been released for these vulnerabilities yet. Until the vendor provides an update, organizations must rely on compensating controls and enhanced monitoring. The CVSS score of 5.5 for CVE-2026-105133 may underestimate the operational risk when combined with the second flaw. The ability to run OS commands remotely without authentication represents a critical failure in the security model of the backup appliance.

What to do and how to stay safe: AhsayCBS

• Review server logs for unexpected OS command executions or new user account creations on AhsayCBS instances.
• Monitor process lists for XMRig miners that may be disguised as legitimate applications like Microsoft Edge.
• Restrict network access to AhsayCBS management interfaces to trusted IP addresses only to reduce exposure.
• Isolate any AhsayCBS servers showing signs of unauthorized web shells until the vendor releases a security update.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the AhsayCBS vulnerabilities?

The vulnerabilities are identified as CVE-2026-105133 and CVE-2026-105134.

Is there a patch available for these flaws?

No fix has been confirmed yet; organizations should wait for the vendor to provide an update.

What is the CVSS score for CVE-2026-105133?

CVE-2026-105133 has a CVSS v4 score of 5.5.