Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Crypto Miners

· Cybersecurity

Threat actors are exploiting two still-unpatched vulnerabilities in the AhsayCBS backup management platform to seize control of affected devices, deploy web shells, and install XMRig cryptocurrency miners disguised as Microsoft Edge. The flaws are CVE-2026-105133, an improper authentication issue in the check component rated 5.5 under CVSS v4, and CVE-2026-105134, which allows OS command injection; together they let attackers bypass authentication and run commands on the host. Because AhsayCBS is a backup product, compromised instances give attackers a foothold on systems that often hold sensitive data and privileged credentials. No patch is currently available, leaving defenders to rely on mitigation and monitoring.

Why it matters：Backup infrastructure is a high-value foothold for ransomware and data theft, and with no patch available defenders must rely on detection and network controls.

Key points

  • Two flaws: CVE-2026-105133 (improper authentication, CVSS v4 5.5) and CVE-2026-105134 (OS command injection)
  • Attackers deploy web shells and XMRig miners disguised as Microsoft Edge
  • No patch is available for the vulnerabilities

Sources (original reporting)

More stories from this day