Ahsay Backup Flaws Chained to Bypass Auth, Drop Web Shells and Miners

Key points

• CVE-2026-105133 and CVE-2026-105134 affect AhsayCBS backup software.
• Chaining the flaws allows authentication bypass and arbitrary command execution.
• Post-exploitation activity included web shells and XMRig cryptomining.
• Ahsay issued fixes; the number of compromised organizations is unknown.

Ahsay, a vendor of backup and recovery solutions, has addressed two security defects in its AhsayCBS product. Tracked as CVE-2026-105133 and CVE-2026-105134, the vulnerabilities were exploited by attackers during 2026. When combined, the flaws permit an intruder to circumvent authentication and run arbitrary commands on vulnerable servers.

After gaining access, the attackers dropped web shells to maintain persistent remote control and installed XMRig to mine cryptocurrency using the compromised system's resources. This combination of backdoor access and resource theft suggests a financially motivated operation that also values long-term footholds.

Organizations running internet-facing AhsayCBS instances are at risk. The total number of victims has not been specified. Backup infrastructure is an attractive target because it frequently stores sensitive data and holds privileged credentials that can be used to move deeper into a network.

Ahsay has published security updates to correct the issues. Administrators should apply them without delay. Since the two flaws can be chained, leaving either unpatched may keep a system exploitable. The incident underscores that backup software, often overlooked, remains a viable entry point for attackers.

Watch for indicators such as unexpected web shell files in web directories, unusual XMRig processes, outbound connections to mining pools, and anomalous authentication events. Monitor backup servers for signs of lateral movement, and review logs for command execution attempts.

What to do now

1. Immediately apply the vendor's security updates for AhsayCBS that address CVE-2026-105133 and CVE-2026-105134.
2. Remove direct internet exposure from backup servers; require VPN or IP allowlisting for administrative access.
3. Scan web-accessible directories for web shells, focusing on recently created or modified script files.
4. Check for XMRig by reviewing CPU usage, mining pool connections, and unauthorized scheduled tasks or services.
5. Audit authentication logs for bypass attempts and successful logins from unusual locations; rotate credentials and API keys.
6. Enable multi-factor authentication for backup console access where supported.
7. If compromise is suspected, isolate affected systems, preserve evidence, and rebuild from clean backups.

CVE references

• CVE-2026-105133
• CVE-2026-105134

Original source

The Hacker News