Unpatched AhsayCBS Backup Platform Vulnerabilities Exploited to Deploy Webshells and Crypto Miners
What Happened — Threat actors leveraged two unpatched flaws in the AhsayCBS backup‑management solution (CVE‑2026‑105133 auth‑bypass and CVE‑2026‑105134 OS command injection) to install JSP web‑shells and XMRig cryptocurrency miners on at least five MSP‑hosted environments.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of gaps in vulnerability‑management and patch‑deployment processes – a core control that continuous‑monitoring programs must evidence.
- Shows how a single unpatched component can cascade into persistent back‑doors, undermining the audit trail for system integrity.
- Highlights the need for verifiable evidence that remediation actions (patches, IP‑based restrictions) are applied and logged across all managed assets.
Who Is Affected – Managed Service Providers, system integrators, and any organization that relies on AhsayCBS for backup and recovery.
Recommended Actions – Immediately restrict the AhsayCBS management interface to trusted IP ranges, verify patch status (upgrade to 10.3.2 or later), scan for the published IoCs, and capture remediation evidence for audit readiness.
Technical Notes – CVE‑2026‑105133 (critical auth‑bypass) and CVE‑2026‑105134 (medium OS command injection) were chained to gain admin access, deploy JSP web‑shells, and run a PowerShell‑based XMRig miner hidden behind a forged MicrosoftEdgeUpdateSvc. Indicators of compromise and Sigma rules are available from Huntress.
Source: BleepingComputer