AhsayCBS vulnerabilities let attackers plant Edge‑named crypto miner

The two AhsayCBS vulnerabilities let a remote attacker get in without a password and then run any command they like. They are:

• CVE-2026-105133 (CVSS v4 score 5.5, medium): an improper authentication flaw in the checkSysPwd() function, which lets an attacker skip the login check.
• CVE-2026-105134 (CVSS v4 score 9.3, critical): an operating system command injection flaw in the Replication Receiver component, which lets the attacker run code on the server with full SYSTEM privileges.

Used together, the first opens the door and the second takes over the machine. Security firm Huntress found that the Replication Receiver API would accept a random token in place of real credentials. The attacker then set up a malicious receiver and dropped a JSP web shell (a small program that gives remote control through a web page) into the folder the CBS web app serves.

The flaws were made public on October 4, 2026, with a warning that exploit code was already available. Huntress says attacks began on October 7 at 11:20 p.m. UTC, and by October 8 at least five organizations had been targeted, with one more incident seen afterward.

Once inside, the attackers looked around the network, planted web shells and installed XMRig, a popular cryptocurrency mining program, under the name edge.exe. A miner quietly uses the victim’s processing power and electricity to generate coins for the attacker.

To keep it running, they created a Windows service named MicrosoftEdgeUpdateSvc that launches msedge.exe, which is actually a modified copy of NSSM, a legitimate tool for keeping programs running after crashes or reboots. Everything is named to look like normal browser updates.

The cleverest piece is a PowerShell script called Taskgmr.ps1, launched with curl, which Huntress believes was written with help from an AI tool. It pauses mining the moment someone opens Windows Task Manager and restarts it when Task Manager closes. It also kills Task Manager at 6 p.m. local time, or if it has been open for more than an hour overnight.

In at least one case, the attackers used the built-in Windows tool certutil.exe to download WinRing0x64.sys, a legitimate but vulnerable driver, into the TEMP folder. That likely gave the miner kernel-level access to squeeze more out of the hardware.

This is the part that caught administrators out. Official advisories first listed the bugs as fixed in earlier versions, but Huntress found that version 10.3.4, then the newest release, was still vulnerable, effectively turning the flaws into zero-days (bugs with no working fix).

In an October 12 alert, Ahsay admitted that its previous patches, version 9.15.2 build fifty-nine and version 10.3.4 build zero, did not completely fix either flaw, and urged partners to take immediate action. It has now released two hotfixes through its partner portal:

• v10 servers: install AhsayCBS 10.3.4 build forty-five.
• v7, v8 and v9 servers: install version 9.15.2 build seventy.

Ahsay asks administrators to reboot the server after applying them. Huntress says its testing confirmed the build forty-five hotfix blocks the first step of the attack chain.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until October 17, 2026, to deal with them. That deadline has passed, so any agency or contractor still unpatched is out of compliance.

If you run AhsayCBS, treat this as urgent. If you’re a small business that pays an IT provider for backups, it’s reasonable to ask them directly whether they use Ahsay and whether they’ve installed the new hotfixes.

Here’s the checklist for administrators:

• Patch: apply version 10.3.4 build forty-five or version 9.15.2 build seventy and reboot.
• Lock down access: limit the management interface to trusted IP addresses or put it behind a VPN, since the exploit targets the internet-facing web service.
• Hunt for signs: look for edge.exe, msedge.exe outside the normal Edge folder, a MicrosoftEdgeUpdateSvc service, Taskgmr.ps1, WinRing0x64.sys in TEMP, and unfamiliar JSP files in the CBS web directory.
• If compromised: do a full restore of the host from a clean backup, because the attackers may have left other backdoors.

Huntress has published indicators of compromise and four Sigma detection rules to help security teams search for this activity.