Criminals Are Chaining Two Backup-Software Flaws to Mine Crypto on Company Servers
A critical bug in AhsayCBS lets attackers run any command they like on a victim's server without a password. At least five organisations were hit before a fix even existed.
Key points
- Attackers chained two flaws in AhsayCBS backup software to break into at least five organisations by 8 October 2026, according to Huntress.
- CVE-2026-105134 is rated critical and lets a criminal run commands on a server without ever logging in.
- CVE-2026-105133 scores 5.5 and lets an attacker bypass the software's password check by substituting a random token for real credentials.
- Both flaws were published by NIST on 4 October 2026 with a note that working exploit code was already public.
- Huntress found that version 10.3.4, the most recent release, is also vulnerable, meaning no patch currently exists.
AhsayCBS is a centralised backup management console, meaning it's the single piece of software that businesses and managed service providers (MSPs, companies that look after another firm's IT) use to control all of their data backups. When that console is broken into, everything it oversees is reachable.
Two vulnerabilities in the product, both published to the U.S. Government's National Vulnerability Database on 4 October 2026, are now being exploited together. The weaker of the pair, CVE-2026-105133 (CVSS 5.5), sits inside a function called checkSysPwd in the software's API (a programming interface that lets different parts of software talk to each other). Feed that function a random token, a meaningless string of characters, instead of a valid password, and the software waves you through.
That unlocks the second flaw. CVE-2026-105134 (critical) lives in the Replication Receiver component, a part of the software that handles data copying between servers. Once the first bug clears the login gate, this one allows OS command injection, meaning the attacker can type a system command directly into the server's operating system as if they were sitting at the keyboard, with full System-level privileges.
What did the attackers actually do once they were in?
They installed a cryptocurrency miner and then worked hard to stop anyone noticing. Huntress, the cybersecurity firm whose researchers caught the campaign, found that after gaining access the attackers dropped a webshell (a small hidden script that gives permanent remote control over a web server) into the AhsayCBS application directory.
From there they deployed XMRig, a well-known cryptocurrency mining program, disguised as Microsoft Edge. They used a legitimate but abused utility called NSSM to create a Windows service that would restart the miner automatically after a reboot or crash, naming it to look like a genuine Microsoft Edge update. One attack also loaded a kernel driver called WinRing0x64.sys to give the miner the deepest possible access to the machine's processor.
Perhaps the most telling detail: the attackers planted a PowerShell script, apparently written with AI assistance, that watches Windows Task Manager and kills it if a user leaves it open too long. It's a direct attempt to stop an IT administrator spotting the miner in the process list. We've covered Huntress's research eleven times in the past 90 days, and their findings here sit alongside a pattern we've tracked since late September: unpatched network-facing software being hit before vendors ship a fix.
| Detail | Value |
|---|---|
| Affected versions | AhsayCBS up to and including 10.3.2 (10.3.4 also affected per Huntress) |
| CVE-2026-105133 severity | CVSS 5.5, Medium |
| CVE-2026-105134 severity | Critical |
| Exploit status | Publicly available as of 4 October 2026 |
| Confirmed patch | None at time of writing |
| Organisations targeted | At least 5 as of 8 October 2026 |
What should businesses running AhsayCBS do right now?
No patch exists yet. The fix noted in the NVD records, version 10.3.4, doesn't close these flaws according to Huntress. Until Ahsay Systems releases a confirmed fix, the only practical defence is to make the management interface invisible to the open internet. Restrict access to trusted internal IP addresses or require a VPN (a private, encrypted tunnel into the company network) before anyone can reach the login page.
Any organisation that has left the management console publicly accessible should treat their server as potentially compromised and check for unexpected processes, unfamiliar Windows services with names resembling Microsoft Edge, and unusual outbound network traffic. MSPs should extend that check to every customer environment they manage from a shared console, because a single compromised console puts every client behind it at risk.
A no-password, remote, full-system-control bug with public exploit code and active exploitation is about as bad as it gets. The absence of a working patch makes the exposure window entirely open-ended, and that's the number that matters here, not the CVSS score.
