AhsayCBS Vulnerability Exploitation Dropping XMRig Miner

Threat actors are exploiting critical authentication bypass and RCE flaws in AhsayCBS backup servers to deploy JSP webshells and XMRig cryptominers.

CVE-2026-105133 CVE-2026-105134

Executive Summary

In October 2026, researchers identified active exploitation targeting AhsayCBS backup servers via two vulnerabilities: CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (remote code execution). These flaws allow unauthenticated attackers to execute commands as NT AUTHORITY\SYSTEM through the Replication Receiver component.

The attack chain bypasses authentication and drops JSP webshells. In other intrusions the AhsayCBS service process (cbssvcX64.exe) ran curl and certutil to download tools.. Payloads include an XMRig miner and a modified NSSM wrapper disguised as Microsoft Edge components, along with a vulnerable kernel driver (WinRing0x64.sys) to maximize mining efficiency.

This campaign poses a significant risk to organizations using unpatched AhsayCBS software (versions up to 10.3.4), leading to full system compromise and unauthorized resource consumption. Immediate patching to versions 10.3.4[.]45 or 9.15.2[.]70 is required to mitigate these risks.

Key Details

Threat Name

AhsayCBS Vulnerability Exploitation

Affects

AhsayCBS versions up through 10.3.4, AhsayCBS v10, AhsayCBS v7, AhsayCBS v8, AhsayCBS v9

Adversary

—

MITRE Techniques

T1190 T1505.003 T1105 T1059.001 T1543.003 T1036 T1496 T1068

Malware/Tools

XMRig

Report Score

9out of 10

Quality Score

Excellent

IOC Quality9

TTP Details9

Detection Guidance7

Enterprise Relevance9

Clarity & Structure10

Technical Depth7