Two AhsayCBS Flows Bypass Auth, Let Attackers Run OS Commands and Miners

Security researchers have confirmed that threat actors are actively exploiting two unpatched vulnerabilities in AhsayCBS, a backup utility widely used for data protection. According to reports from SecurityWeek and The Hacker News, attackers are leveraging these flaws to seize control of affected devices. Once inside, the attackers deploy web shells and XMRig cryptocurrency miners, which they disguise as Microsoft Edge processes to avoid detection.

The risk

The core issue involves two recently disclosed flaws: CVE-2026-105133 and CVE-2026-105134. CVE-2026-105133 is an improper authentication vulnerability located in the `checkSysPwd()` function within the `com/ahsay/obs/api/ApiStructsAction.java` file. This flaw carries a CVSS v4 score of 5.5. The second vulnerability, CVE-2026-105134, allows attackers to inject operating system commands. Together, these issues enable remote attackers to bypass authentication mechanisms and execute arbitrary commands on the host system. This level of access allows for the installation of persistent backdoors, such as web shells, and the deployment of resource-intensive malware like crypto miners.

Who is exposed

Organizations using AhsayCBS for backup operations are exposed to these threats. Because the vulnerabilities allow for remote exploitation without valid credentials, any instance of the software accessible from the internet or internal networks is at risk. The active exploitation observed in the wild indicates that attackers are scanning for vulnerable installations and moving quickly to compromise them. The disguise of the XMRig miner as Microsoft Edge adds a layer of complexity to detection, as the process name may not immediately raise alarms in standard process lists.

Cost and compliance

The source material does not provide specific figures regarding financial losses or regulatory penalties associated with these incidents. However, the deployment of web shells and unauthorized command execution typically violates security compliance frameworks that require strict access controls and system integrity. Organizations may face indirect costs related to incident response, system downtime, and the computational resources consumed by the cryptocurrency miners.

What should you do?

Managers should immediately verify if their AhsayCBS instances are accessible from untrusted networks and restrict access to trusted IPs where possible. Monitor system processes for any instances of XMRig or processes masquerading as Microsoft Edge that are consuming high CPU resources. Review logs for authentication bypass attempts or unusual command executions originating from the AhsayCBS service.

What to do and how to stay safe: AhsayCBS

• Audit network access controls to ensure AhsayCBS management interfaces are not exposed to the public internet.
• Monitor system resource usage for anomalies, particularly high CPU load from processes named after common browsers like Microsoft Edge.
• Review application logs for signs of authentication bypass attempts or unauthorized command executions.
• Once the vendor provides an update, apply patches immediately to remediate CVE-2026-105133 and CVE-2026-105134.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the exploited AhsayCBS vulnerabilities?

The vulnerabilities are identified as CVE-2026-105133 and CVE-2026-105134.

How are attackers hiding the cryptocurrency miners?

Attackers are disguising the XMRig miners as Microsoft Edge processes to evade detection.

Is there a fix available for these vulnerabilities?

No fix has been confirmed yet; the vulnerabilities are described as unpatched in current reports.