AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 let attackers run code as SYSTEM on MSP backup servers. Here's how to check and patch.
Somewhere right now, an MSP's backup server is mining Monero for a stranger. The miner runs
under the name edge.exe, and a script watches for anyone who opens Task Manager so it can
pause the miner before they notice.
That's the mild outcome. The server it's running on is AhsayCBS, the console many managed service providers use to store and manage every client's backups. The attackers didn't need a password to get in.
AhsayCBS (Ahsay Cloud Backup Suite) is a backup server and management console that is popular with MSPs and system integrators, who use it to host backup policy, storage and user accounts for their clients. A single server often holds backups for many different client businesses.
That's what makes it a target. If you compromise one company's laptop, you get one company. If you compromise its MSP's backup console, you're on the box that holds copies of every client's data, and it usually has the network access needed to reach all of them.
Think of it as the building's key cabinet. Nobody steals a single key when they can take the whole cabinet.
The attack uses two bugs together: CVE-2026-105133 gets the attacker past the login, and CVE-2026-105134 lets them run commands on the server as SYSTEM. Neither bug is enough on its own to take over the server.
CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function of the
AhsayCBS API. VulDB, the CVE numbering authority for both bugs, rates it CVSS 4.0 5.5
(Medium). Per Huntress, the Replication Receiver API could be fooled into accepting a
random token in place of real credentials.
A Medium rating sounds reassuring until you remember what's behind the door.
CVE-2026-105134 is an OS command injection in the Replication Receiver endpoint,
/rps/api/json/UpdateReceivers.do. VulDB rates it CVSS 4.0 9.3 (Critical). Command
injection means attacker-controlled input ends up in a command the server runs, so the
attacker can make the server execute anything they like. AhsayCBS runs it as SYSTEM, the
highest privilege level on Windows.
Chained together, the two bugs give pre-authentication remote code execution: no account, no phishing and no user interaction.
Yes. Huntress observed attackers exploiting the AhsayCBS chain from October 7, 2026, at 23:20 UTC, and CISA added both CVEs to the KEV catalog on October 14, 2026. Here's the timeline:
| Date (2026) | Event |
|---|---|
| Oct 4 | CVE-2026-105133 and CVE-2026-105134 published to NVD; exploit code already public |
| Oct 7 | Huntress sees the first in-the-wild exploitation |
| Oct 8 | Huntress reports five targeted organisations and confirms 10.3.4 is affected |
| Oct 10 | Ahsay notice: v10.3.4.0 "did not fully address" either CVE |
| Oct 12 | Hotfixes released: 10.3.4.45 (v10) and 9.15.2.70 (v7–v9) |
| Oct 14 | Both CVEs added to CISA KEV |
That's three days from public CVE to live attacks, and eight days with no working fix. Anyone who patched to 10.3.4 early and called it done was still exposed.
Huntress documented the post-exploitation activity in detail:
curl and certutil, launched by the AhsayCBS service (cbssvcX64.exe), to download
tools from an Alibaba Cloud storage bucket.edge.exe, run by a modified NSSM service
wrapper called msedge.exe under a new SYSTEM service named MicrosoftEdgeUpdateSvc.WinRing0x64.sys, a legitimate but vulnerable kernel driver, so the miner gets
low-level hardware access.Taskgmr.ps1, a script Huntress says looks AI-assisted. It stops the miner while
Task Manager is open and kills Task Manager if it stays open too long.The crypto miner is the noisy part. The webshell is the part that matters.
A miner pays the attacker in electricity. A webshell on a SYSTEM-level backup console is access they can keep, sell, or hand to someone with bigger plans. Backups are one of the first things ransomware crews go after, because destroyed backups leave the victim with no way to recover except paying.
You are affected if you run an AhsayCBS v10 build below 10.3.4.45, or a v7, v8 or v9 build below 9.15.2.70, especially if its web console can be reached from the internet. Check these three things:
/rps/ API paths, answers. If a stranger can load it, so can an attacker.Install hotfix 10.3.4.45 (for v10) or 9.15.2.70 (for v7–v9) from the Ahsay partner portal, reboot, and restrict the management console to trusted IPs or a VPN. Then check whether you were already compromised, because patching does not remove a webshell that's already there.
Patch and lock down:
Hunt for compromise:
cbssvcX64.exe that shouldn't be there, such as curl, certutil,
powershell or cmd..jsp files in the AhsayCBS web directories, and replication receivers you didn't
create.MicrosoftEdgeUpdateSvc service, or edge.exe / msedge.exe outside Microsoft's own
install folders.WinRing0x64.sys on disk, Taskgmr.ps1 anywhere, and outbound traffic to
xmr.kryptex[.]network on port 8029.If you find any of these, re-image the server. Huntress recommends rebuilding the host from a trusted backup because the attackers hid secondary backdoors. Then rotate every credential the server stored, including your clients' storage and destination credentials.
This isn't the first time an MSP tool has been turned against an MSP's clients. Remote monitoring tools, remote access tools and backup consoles all have the same problem: they're trusted, privileged, and connected to every client network. That makes one bug in them very valuable.
The uncomfortable part is that most MSPs rigorously test their clients' perimeter and rarely point the same scrutiny at their own management stack. Attackers do the opposite.
The AhsayCBS chain is exactly what an external network pentest is meant to catch before an attacker does. You'd want to know that an admin console is reachable from the internet, which build it reports, whether that build is on CISA KEV, and whether its authentication holds.
KinoSec is an autonomous AI pentesting platform built for MSPs and MSSPs. Point it at your own IP ranges and your clients' external networks, web apps and Active Directory, and it runs the pentest end to end. It covers reconnaissance, fingerprinting exposed services like management consoles, testing for exploitable weaknesses, and chaining findings across surfaces the way a human red team would. The result is a plain-language report, with remediation steps, that you deliver under your own brand.
Run it once on your own estate before you run it on anyone else's. If you have an AhsayCBS console you forgot about, you want to be the one who finds it.
CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function of AhsayCBS,
rated CVSS 4.0 5.5. CVE-2026-105134 is an OS command injection in the AhsayCBS Replication
Receiver endpoint /rps/api/json/UpdateReceivers.do, rated CVSS 4.0 9.3. Chained, they give an
unauthenticated attacker remote code execution as SYSTEM on the AhsayCBS backup server.
Yes. Ahsay released hotfix 10.3.4.45 for AhsayCBS v10 and hotfix 9.15.2.70 for v7, v8 and v9 on October 12, 2026, through its partner portal, and a reboot is required. Ahsay says the earlier 10.3.4.0 release did not fully fix either CVE. Huntress verified that 10.3.4.45 blocks the initial entry point.
Yes. CISA added both CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities catalog on October 14, 2026. Huntress had observed in-the-wild exploitation since October 7, 2026, with five organisations targeted by October 8.
Look for unexpected child processes of cbssvcX64.exe (such as curl, certutil or
PowerShell), unfamiliar .jsp files in the web directories, rogue replication receivers, a
MicrosoftEdgeUpdateSvc service, and fake edge.exe or msedge.exe binaries. Huntress
observed attackers deploying webshells and an XMRig cryptominer. If you find any of these,
re-image the host and rotate all stored credentials.
Backup servers hold copies of many organisations' data and usually have trusted network access to all of them. AhsayCBS is used mainly by MSPs and system integrators, so one compromised console can expose many client businesses. Backups are also what victims need to recover from ransomware, which makes them an early target for ransomware attackers.