AhsayCBS bugs exploited for web shells, new fixes out

What Happened

Ahsay Backup, a Singapore-based vendor, has shipped a second round of fixes for two vulnerabilities in its AhsayCBS centralized backup server product after confirming that attackers exploited them to deploy web shells and XMRig cryptocurrency miners. The flaws are tracked as CVE-2026-105133 (an authentication bypass) and CVE-2026-105134 (a remote code execution issue). The new release follows the discovery that the vendor’s initial patches were incomplete and could be bypassed, leaving systems exposed even after administrators applied the first update.

Why It Matters

AhsayCBS is not a fringe tool. It sits at the center of backup infrastructure for managed service providers and mid-market enterprises, holding credentials, configuration data, and often direct paths into the systems it protects. Backup servers are a high-value target precisely because they concentrate trust: compromise the backup appliance and you gain a foothold that survives endpoint remediation. The fact that attackers are mining cryptocurrency on these hosts is a warning sign, not the end goal. It signals that opportunistic actors have already indexed exposed instances and validated an exploitation path, and more structured threats are likely to reuse the same access for ransomware staging.

Technical Details

The exploitation chain pairs the authentication bypass in CVE-2026-105133 with the code execution flaw in CVE-2026-105134. Attackers use the bypass to reach privileged functionality without valid credentials, then abuse the RCE to write web shells to web-accessible directories and drop XMRig binaries that consume CPU and masquerade as legitimate services. Both CVEs have proof-of-concept material circulating, and the incomplete first-round patches mean a version check alone is insufficient to confirm remediation. Administrators must verify the exact build number against Ahsay’s latest advisory rather than assuming the previous update closed the gap.

Immediate Risk

Any internet-facing AhsayCBS instance is at immediate risk. Exploitation requires no user interaction, and the payoff for attackers is durable access. Exploited hosts should be treated as fully compromised: web shells and miners frequently coexist with credential theft tooling and persistence mechanisms, so removing the miner without hunting for the shell leaves access intact. Organizations should audit web directories for unexpected scripts, review process trees for anomalous high-CPU tasks, and rotate credentials for anything the backup server could reach.

Security Insight

Incomplete patches are a recurring failure mode that turns defenders into unwitting targets. The dynamic here echoes the 2023 move against MOVEit and the repeated CVE-2024-3400 re-patches in Palo Alto’s GlobalProtect: attackers monitor vendor advisories, download the first fix, and build bypasses before many admins have even patched once. The defensive takeaway is sequencing. When a vendor revises a patch, treat the vulnerable window as still open and prioritize post-patch integrity checks, not the original update timestamp. Security teams should also check breach reports for Ahsay-linked incidents to gauge whether their exposure aligns with known compromises.

Further Reading

• AhsayCBS RCE actively exploited (CVE-2026-105134) [PoC]
• AhsayCBS auth bypass, exploited in wild (CVE-2026-105133) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports