Updated October 15, 2026: Ahsay posted an announcement dated October 12 saying its earlier v9.15.2.59 and v10.3.4.0 patches "did not fully address" CVE-2026-105133 and CVE-2026-105134, and released hotfixes v10.3.4.45 (v10) and v9.15.2.70 (v7, v8, v9). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 14 with an October 17 due date. This post no longer says no patch exists.

If you run AhsayCBS and believe 10.3.4 protects you from CVE-2026-105134, you are wrong, and the public CVE record is part of the reason. Huntress says attackers are exploiting the flaw and that 10.3.4 is affected too, and Ahsay has since conceded that its 10.3.4.0 patch did not fully fix it. The MITRE record still says the opposite.

RelatedCitrix NetScaler Zero-Days CVE-2026-88771/88772: Patch Now

What is being exploited in AhsayCBS?

Huntress published its findings on October 8, 2026, under the title "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer." It saw exploitation starting at 23:20:15 UTC on October 7, and as of October 8 it had seen five organizations targeted.

Two bugs are chained:

  • CVE-2026-105133 (medium): improper authentication in the checkSysPwd function.
  • CVE-2026-105134 (critical): unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do.

Attackers pair the two to get code running as SYSTEM on the backup server. That is about the worst place to lose control of, since a backup service sits next to everything an organization wants to keep safe. For triage, our CVE watchlist now tracks both CVEs.

What do the attackers do after getting in?

Huntress described a fairly noisy toolkit. The post-exploitation steps it documented:

  • JSP webshells dropped into the application directory served by CBS.
  • An XMRig cryptominer renamed edge.exe.
  • A Windows service called MicrosoftEdgeUpdateSvc that runs a renamed NSSM binary (msedge.exe) as SYSTEM, which keeps the miner alive across reboots.
  • A PowerShell script, Taskgmr.ps1, that hides the miner by watching Task Manager and killing the process at set times.
  • The vulnerable kernel driver WinRing0x64.sys, loaded in one incident.

The naming is deliberate camouflage: Edge-flavored service and file names are easy to skim past on a server nobody logs into often. Webshells are the more serious find. A miner only burns electricity, but a webshell is a standing door that survives a miner cleanup.

Is AhsayCBS 10.3.4 vulnerable to CVE-2026-105134?

Yes, according to Huntress. In an update marked 10/8/26 at 6pm ET, it determined that Ahsay 10.3.4 is also affected, writing that "AhsayCBS versions up through 10.3.4 are affected by this issue." At the time it said no patch was available, and that it contacted Ahsay and shared its research.

We checked the other side of the story at 03:38 UTC on October 12. The CVE records for both bugs were published on October 4, 2026 and last updated on October 5. Both still list 10.3.0, 10.3.1 and 10.3.2 as affected and 10.3.4 as unaffected. Both also tag Ahsay's 10.3.4 release notes as the patch reference.

Those release notes are dated 05-Aug-2026 and list no security fixes. Their bug fixes cover general items, backup destinations, Microsoft 365 and Proxmox VE. No version newer than 10.3.4 is listed. As of 03:38 UTC on Oct 12, Ahsay had not published a fixed version.

Later that day Ahsay posted an announcement for partners saying the v9.15.2.59 and v10.3.4.0 patches "did not fully address" both CVEs. It released two hotfixes: v10.3.4.45 for the v10 line, including 10.3.4, and v9.15.2.70 for v7, v8 and v9, and tells partners to reboot the server after applying them. So 10.3.4 is not safe, and 10.3.4.45 is the build to look for.

RelatedGoogle Fixes Actively Exploited Pixel Modem Flaw

How the record and the exploitation line up

  1. Aug 5AhsayCBS 10.3.4 released. Release notes list no security fixes.
  2. Oct 4Both CVE records published. 10.3.4 marked unaffected.
  3. Oct 7, 23:20 UTCFirst exploitation Huntress observed.
  4. Oct 8Huntress report, then the 6pm ET update. 10.3.4 declared affected.
  5. Oct 12Records still say 10.3.4 is unaffected. Checked at 03:38 UTC.
  6. Oct 12Ahsay ships hotfixes 10.3.4.45 and 9.15.2.70. Says 10.3.4.0 did not fully fix the bugs.
  7. Oct 14CISA adds both CVEs to KEV. Federal due date Oct 17.

The CVSS scores in the records are not subtle. CVE-2026-105134 carries a CVSS 4.0 score of 10 (critical) and a CVSS 3.1 score of 10. CVE-2026-105133 is 6.9 (medium) under 4.0 and 7.3 under 3.1. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 14, 2026, with a remediation due date of October 17.

The scanner problem with a wrong CVE record

Vulnerability scanners and patch tools commonly read the CVE record's affected-version data. If that data says 10.3.4 is unaffected, an admin who upgraded to 10.3.4 will see a clean result and stop worrying. Meanwhile the researchers watching live attacks say that version is exposed. Treat a green scan on AhsayCBS 10.3.4 as unreliable until the record is corrected. The build that carries the fix is 10.3.4.45, not 10.3.4.

What to do now

Install Ahsay's hotfix first: v10.3.4.45 on the v10 line or v9.15.2.70 on v7, v8 and v9, then reboot the server, as Ahsay instructs. Ahsay distributes the hotfixes through its partner portal.

Huntress recommends restricting access to the AhsayCBS management interface to trusted IPs or a VPN, and investigating for compromise. If you find indicators, it says to fully re-image from a trusted backup, not just delete the miner.

Indicators from the Huntress report (defanged):

  • IPs: 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10, 123.202.208[.]37
  • Mining pool: 51.195.127[.]124:8029 and xmr.kryptex[.]network:8029

Also look for the MicrosoftEdgeUpdateSvc service, edge.exe and msedge.exe outside real Edge directories, Taskgmr.ps1, and unexpected .jsp files in the CBS application directory.

Primary sources