Key points
- Attackers chained CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute commands on AhsayCBS servers.
- Huntress observed the campaign targeting five organizations, with initial activity detected on October 7, 2026.
- Version 10.3.4 remains vulnerable despite earlier vendor guidance indicating a fix, complicating patching efforts for administrators.
Huntress researchers identified active exploitation of two security flaws in the AhsayCBS backup management platform, resulting in unauthorized access and cryptocurrency mining operations. The campaign targeted managed service providers and system integrators who rely on the software for client backup policies. Threat actors successfully deployed webshells and disguised miners on at least five distinct organizations, according to Huntress.
How it unfolded
- On October 7, 2026, at 23:20:15 UTC, Huntress first detected exploitation activity against AhsayCBS servers, marking the start of the observed campaign.
- By October 8, researchers confirmed that five organizations had been targeted, with attackers performing reconnaissance and establishing persistence mechanisms on the affected hosts.
- Attackers chained CVE-2026-105133, an authentication bypass, with CVE-2026-105134, a command injection flaw, to gain SYSTEM-level control over the Windows hosts.
Who is affected
The AhsayCBS platform is primarily used by managed service providers and system integrators to manage backup users and policies. Huntress found that versions up to 10.3.4 are affected by the exploited vulnerabilities. Although earlier reports indicated that version 10.3.2 contained fixes, Huntress confirmed that 10.3.4, the current latest release, also remains vulnerable. This discrepancy creates significant risk for administrators who may believe their systems are already patched.
Attackers leveraged the flaws to bypass login checks and execute commands as NT AUTHORITY\SYSTEM. This high-privilege access allowed them to place Java Server Page webshells within the
Background: Unauthorized access
Yes, they are different. Unauthorized access means entering a system without permission. Unauthorized use means entering with permission but acting beyond allowed boundaries. Access violations trigger perimeter alerts. Use violations require behavioral analysis to detect, as the actor already possesses valid credentials and expected network presence.
Read the full guide: Difference Between Unauthorized Access and Unauthorized Use Explained
