Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Two vulnerabilities in AhsayCBS, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (OS command injection), remain unpatched in version 10.3.4, despite fixes claimed in 10.3.2. Attackers exploit CVE-2026-105133 to bypass authentication and then leverage CVE-2026-105134 to execute arbitrary code. Observed attack behavior includes reconnaissance, deployment of JSP webshells, and installation of the XMRig cryptocurrency miner disguised as edge.exe. The miner persists via a service named 'MicrosoftEdgeUpdateSvc' running a modified NSSM utility. A PowerShell script is used to conceal mining activity by manipulating Task Manager behavior. In one instance, a vulnerable driver (WinRing0x64.sys) was deployed to enhance mining capabilities. The attacks have been observed in the wild targeting MSPs and system integrators using AhsayCBS.

Successful exploitation allows attackers to bypass authentication and execute arbitrary OS commands on affected AhsayCBS servers. This leads to unauthorized access, deployment of persistent webshells, and installation of cryptocurrency mining malware, which can degrade system performance and increase operational costs. The attacker may also install additional backdoors, enabling prolonged unauthorized access and further compromise.

No official patch status is confirmed; patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the AhsayCBS management interface to trusted IP addresses only. Investigate signs of compromise thoroughly. If compromise is confirmed, perform a full restore of the host from a known safe backup to remove potential backdoors. Use provided indicators of compromise and detection rules from security researchers to identify malicious activity.