Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Cryptominers
Summary
Attackers are exploiting two unpatched AhsayCBS vulnerabilities for unauthenticated remote code execution. Huntress says at least five organizations were targeted, and recommends restricting access to the management interface while investigating for compromise.
Key points
- CVE-2026-105133 and CVE-2026-105134 can be chained to bypass authentication and execute operating-system commands.
- Huntress reports that AhsayCBS 10.3.4 is affected; versions up to 10.3.2 were also identified as vulnerable.
- Attackers reportedly gained unauthenticated remote access, installed JSP webshells, and conducted reconnaissance.
- Observed payloads included XMRig cryptominers disguised as Microsoft Edge and a PowerShell script that monitored Task Manager.
- Attackers established persistence using a Windows service masquerading as Microsoft Edge Update; one attack also used a vulnerable kernel driver to support mining.
- No patch was available at the time of the report. Huntress advises restricting management-interface access to trusted IPs or requiring a VPN, and checking for signs of compromise.
Article Details
- Vulnerability Types
- Authentication bypass
- OS command injection
- Affected Versions
- All AhsayCBS versions up to 10.3.2
- 10.3.4
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- unavailable
- Workarounds
- Restrict access to the management interface to trusted IP addresses or require VPN access.
MITRE ATT&CK
T1059.001 · PowerShellAttackers planted a PowerShell script that monitored Task Manager and terminated it if it remained open too long.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in the externally accessible AhsayCBS web application to gain initial access.T1496 · Resource HijackingAttackers deployed XMRig cryptominers to mine cryptocurrency.T1505.003 · Web ShellAttackers dropped a JSP webshell into the application directory served by the CBS application.T1543.003 · Windows ServiceAttackers created a Windows service masquerading as Microsoft Edge Update to run a modified copy of NSSM.
CVE
CVE-2026-105133Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.CVE-2026-105134Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.