Search: CVE-2026-105133

CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS affecting versions up to 9.15.2.69 and 10.3.4.44. The flaw exists in the checkSysPwd function of the API component, where manipulation of the 'random' argument allows remote attackers to bypass authentication. Public exploit code is available, and exploitation in the wild is confirmed. The initial patch was insufficient, but upgrading to versions 9.15.2.70 and 10.3.4.45 mitigates the issue.

Starting October 7, 2026, attackers exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to perform unauthenticated remote code execution. They chained these flaws to bypass authentication and execute code with SYSTEM privileges. Post-exploitation, attackers deployed JSP webshells, installed XMRig cryptocurrency miners disguised as Microsoft Edge processes, and used an AI-assisted PowerShell script to hide mining activity by terminating Task Manager. Persistence was maintained via a fake Windows service named MicrosoftEdgeUpdateSvc. Additionally, a vulnerable kernel driver (WinRing0x64.sys) was exploited for kernel-level hardware access to optimize mining. All AhsayCBS versions through 10.3.4 are affected, with managed service providers primarily targeted.