AhsayCBS Authentication Bypass Flaws Exploited to Install Crypto Miners
Attackers are using two unpatched vulnerabilities in the AhsayCBS backup utility to bypass login checks and install malicious software on compromised servers.
Key points
- Two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, are being actively exploited in the wild.
- Attackers bypass authentication to inject operating system commands and deploy web shells.
- Threat actors are installing XMRig cryptocurrency miners disguised as Microsoft Edge processes.
Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup utility to seize control of affected devices. According to SecurityWeek, the flaws allow attackers to bypass authentication mechanisms and inject operating system commands. The Hacker News reports that these exploits are being used to deploy web shells and XMRig cryptocurrency miners on compromised systems.
In plain English
AhsayCBS is a backup solution used by organizations to store and recover data. The reported flaws, identified as CVE-2026-105133 and CVE-2026-105134, create a security gap that lets attackers skip the normal login process. CVE-2026-105133 is specifically an improper authentication vulnerability located in the `checkSysPwd()` function within the `com/ahsay/obs/api/ApiStructsAction.java` file. This vulnerability has a CVSS v4 score of 5.5.
Once attackers bypass the authentication check, they can run commands on the server. They are using this access to install web shells, which are scripts that allow remote control of the server. They are also installing XMRig, a tool used to mine cryptocurrency. To avoid detection, the attackers are disguising the mining software so it appears to be a Microsoft Edge browser process.
The background
The exploitation of these flaws has been observed in the wild, meaning real-world attacks are occurring. SecurityWeek noted the active exploitation of the unpatched vulnerabilities. The Hacker News provided details on the specific malware being deployed, highlighting the use of XMRig miners disguised as legitimate system processes. The combination of authentication bypass and command injection allows for a complete takeover of the affected AhsayCBS instance.
What changes now
Organizations using AhsayCBS need to be aware that their backup servers are potential targets. Since the vulnerabilities allow for remote command execution without proper authentication, the risk is significant. Security teams should monitor for unusual processes, particularly those resembling Microsoft Edge but behaving like miners. The lack of a confirmed patch means that immediate defensive measures are necessary to protect exposed systems.
What to do and how to stay safe: AhsayCBS
- Scan your network for any instances of the AhsayCBS backup utility to determine exposure.
- Monitor server processes for XMRig activity or any Microsoft Edge processes running on backup servers where browsers are not typically used.
- Review logs for unauthorized access attempts or command injections targeting the AhsayCBS API endpoints.
- Isolate affected systems from the network if malicious activity is detected to prevent lateral movement.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the AhsayCBS vulnerabilities?
The vulnerabilities are identified as CVE-2026-105133 and CVE-2026-105134.
What is the CVSS score for CVE-2026-105133?
CVE-2026-105133 has a CVSS v4 score of 5.5.
How are attackers hiding the cryptocurrency miners?
Attackers are disguising the XMRig miners as Microsoft Edge processes.
