The AhsayCBS vulnerability CVE-2026-105134 is being chained with CVE-2026-105133 to run code as SYSTEM on internet-facing Ahsay backup servers, and Huntress has watched it happen since October 7. The CVE records still tell you that upgrading to 10.3.4 resolves it, which Ahsay itself now says is wrong. If you run AhsayCBS, install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9) today, reboot, and hunt the host back to October 4.
What happened
Both CVEs were published on October 4, scored by VulDB, with a public exploit and the advice that AhsayCBS “up to 10.3.2” was affected and 10.3.4 fixed it. Three days later the exploitation started, and the build you actually need changed again before the week was out.
- October 4, 2026: CVE-2026-105133 (authentication bypass, CVSS 3.1 7.3) and CVE-2026-105134 (command injection, CVSS 3.1 10.0) published, both with a public exploit.
- October 7, 23:20:15 UTC: Huntress sees the first exploitation, with webshells and suspicious commands spawned from the AhsayCBS service.
- October 8: Huntress publishes, then updates the same evening to say 10.3.4 is also affected. At least five organizations had been targeted by then, per SecurityWeek.
- October 12: Ahsay states that its “previous patches v9.15.2.59 and v10.3.4.0 did not fully address” the two CVEs and ships new hotfixes. Huntress independently verified that 10.3.4.45 closes the entry point.
Neither CVE was in the CISA KEV catalog when we checked on October 13. We would not wait for that listing, because the exploitation evidence is already public.
Which AhsayCBS build is safe
The trap here is a version number that looks patched. A team that read the CVE record on October 4 and moved to 10.3.4 is still exposed, and so is anyone on the earlier v9 patch.
| Branch | Earlier fix build | Status | Install instead |
|---|---|---|---|
| v10 | 10.3.4.0 (the 10.3.4 the CVE records name) | Still exploitable, per Ahsay and Huntress | 10.3.4.45 hotfix |
| v7, v8, v9 | 9.15.2.59 | Not fully fixed, per Ahsay | 9.15.2.70 hotfix |
Both hotfixes sit behind a partner portal login, and Ahsay asks for a server reboot afterwards. Ahsay’s notice describes no workaround other than the hotfix.
How the AhsayCBS exploit chain works
AhsayCBS is the central console MSPs use to run backup policies and user accounts for many customers at once, which makes it a good place for an attacker to land. The first bug sits in checkSysPwd in ApiStructsAction.java, where manipulating an argument called random breaks authentication. The second is in the Replication Receiver API at /rps/api/json/UpdateReceivers.do. Huntress found that a random token can stand in for valid credentials there, which gives unauthenticated code execution as NT AUTHORITY\SYSTEM.
In the intrusions Huntress investigated, the attacker configured a malicious replication receiver and dropped a JSP webshell into the directory the CBS web application serves. Because AhsayCBS runs its web app inside the service process, every command the webshell runs shows up as a child of cbssvcX64.exe.
What followed was a cryptomining operation rather than ransomware, at least so far. The service spawned curl to pull Taskgmr.ps1, msedge.exe, edge.exe and config.json into %TEMP% from an Alibaba Cloud storage bucket. edge.exe is XMRig, connecting to a Monero pool on port 8029. msedge.exe is a modified copy of NSSM, run as SYSTEM by a new service named MicrosoftEdgeUpdateSvc (the real one is edgeupdate). Taskgmr.ps1, which Huntress says appears to be AI-assisted judging by its commented code, stops that service whenever Task Manager opens and restarts it when Task Manager closes. On one host certutil.exe also fetched WinRing0x64.sys, a legitimate but vulnerable driver that gave the miner kernel-level hardware access.
We take the miner as good news only in a narrow sense. The attacker held SYSTEM on the console that manages backup users and policies for many customers at once, and Huntress warns that attackers have been able to hide secondary backdoors on these hosts. The next group to use this chain may not settle for CPU time.
How to detect AhsayCBS exploitation
Start with Huntress’s four published Sigma rules, especially the one that flags any child of cbssvcX64.exe outside the service’s known startup commands. The two rules below cover steps theirs do not, and the first does not depend on this campaign’s file names at all.
The first rule catches the webshell being written, which happens before any command runs. It maps to ATT&CK T1505.003 and T1190.
Data source: Sysmon Event ID 11 (FileCreate) or EDR file-creation telemetry from the AhsayCBS host
title: AhsayCBS Service Writes JSP File
id: 8f3b1c64-2d7e-4a95-b0c8-5e1f7a9d2c43
status: experimental
description: Detects the AhsayCBS service process creating a .jsp file, consistent with a webshell dropped through CVE-2026-105133 and CVE-2026-105134.
references:
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit
author: MarkCyber Research
date: 2026-10-13
tags:
- attack.persistence
- attack.t1505.003
- attack.initial-access
- attack.t1190
- cve.2026-105134
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- '\cbssvcX64.exe'
- '\cbssvcX86.exe'
TargetFilename|endswith: '.jsp'
condition: selection
falsepositives:
- Ahsay upgrades or hotfixes that unpack web application files through the service; check the timestamp against your change window
level: highThe second rule catches the persistence step, a new Windows service whose binary lives in a temp folder. That pattern matches MicrosoftEdgeUpdateSvc here, and it still fires if the next actor renames the service. It maps to T1543.003 and T1036.004.
Data source: Windows System log, Event ID 7045 (Service Control Manager), forwarded to your SIEM
title: Service Installed From Temp Folder On AhsayCBS Host
id: 1d6a9e27-4c38-4f0b-9a71-3e8c5b2f6d90
status: experimental
description: Detects a new Windows service whose binary sits in a temp directory, as used to persist an NSSM-wrapped XMRig miner after AhsayCBS exploitation.
references:
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit
author: MarkCyber Research
date: 2026-10-13
tags:
- attack.persistence
- attack.t1543.003
- attack.defense-evasion
- attack.t1036.004
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_path:
- ImagePath|contains:
- '\Temp\'
- '\AppData\Local\Temp\'
- ServiceName: 'MicrosoftEdgeUpdateSvc'
condition: selection and selection_path
falsepositives:
- Installers that register a short-lived service from a temp folder during setup; review the service name and signer
level: highNeither rule sees a webshell planted through a path that does not involve the service writing a file, and neither sees an attacker who skips persistence. So also search for the published indicators. They include outbound connections to port 8029 and to xmr.kryptex[.]network, downloads from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, and the six source IPs and three SHA256 hashes in Huntress’s IOC table. Expect those to age quickly. Search back to at least October 4, the day the exploit went public, even though the first confirmed hit was October 7.
Mitigation
- Install AhsayCBS 10.3.4.45 on v10 servers or 9.15.2.70 on v7, v8 and v9 servers from the partner portal, then reboot, per Ahsay’s October 12 notice.
- Restrict the management web interface to trusted IP addresses or put it behind a VPN, which is Huntress’s interim advice and good practice after patching too.
- If any indicator or rule above fires, re-image the host from a trusted backup rather than cleaning it, because Huntress has seen attackers leave secondary backdoors. Then review which customer backup sets and credentials that console could reach.
Backup consoles rarely get the same EDR and log coverage as domain controllers, yet they hold the same keys to recovery. Closing that gap is the kind of AI-driven SOC work we do. We wrote about a similar version trap on SonicWall SMA1000 on October 12, where September’s fix build turned out to be affected by a newer flaw.
Bottom line
Do not trust a 10.3.4 version string. Move every AhsayCBS server to 10.3.4.45 or 9.15.2.70, reboot, lock the console behind a VPN, and search each host for JSP writes and temp-folder services back to October 4.