(diesec.com) Exploitation of Unpatched AhsayCBS Backup Server Vulnerabilities Enables Remote Code Execution and Cryptocurrency Mining
In brief - This article discusses the exploitation of two vulnerabilities in AhsayCBS backup servers that allow unauthenticated remote code execution, noting that initial patches were ineffective.
Technically - This article details a vulnerability chain consisting of CVE-2026-105133 (improper authentication in checkSysPwd) and CVE-2026-105134 (OS command injection via /rps/api/json/UpdateReceivers.do). Attackers leverage an authentication bypass using random tokens to execute code as NT AUTHORITY\SYSTEM, subsequently deploying JSP web shells and a Monero miner (edge.exe) managed by a modified NSSM service (msedge.exe) under the name MicrosoftEdgeUpdateSvc. Mitigation requires installing hotfix 10.3.4.45 for version 10 or 9.15.2.70 for versions 7-9, as version 10.3.4.0 was found to be insufficient.
Source: https://diesec.com/2026/10/ahsaycbs-backup-server-vulnerability-cve-2026-105134/
