cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

AhsayCBS Fixes Two Flaws Exploited to Deploy Web Shells and XMRig Miners

· Original article ↗

Summary

Ahsay released fixes for two AhsayCBS flaws that attackers chained for unauthenticated remote code execution and to deploy web shells and XMRig miners. Earlier patches were incomplete; CISA added both flaws to its KEV catalog.

Key points

  • CVE-2026-105133 and CVE-2026-105134 could be chained to bypass authentication and execute commands on affected AhsayCBS systems.
  • Huntress reported observing attackers exploit the flaws to deploy web shells and XMRig cryptocurrency miners.
  • Ahsay confirmed that its August 2026 releases, versions 9.15.2.59 and 10.3.4.0, did not fully fix the vulnerabilities.
  • Ahsay released additional fixes; Huntress independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the attack chain’s initial entry point.
  • Ahsay recommends applying the hotfix and rebooting the server.
  • CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog and set an October 17, 2026 patch deadline for federal agencies.

Article Details

Vulnerability Types
  • Authentication bypass
  • Arbitrary command execution
Affected Versions
  • AhsayCBS versions 9.15.2.59 and 10.3.4.0 had incomplete patches
  • Previous AhsayCBS v10 versions remained susceptible to the initial entry point
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe chained flaws enabled unauthenticated execution of arbitrary commands on affected systems.T1496 · Resource HijackingThreat actors deployed XMRig cryptocurrency miners on exposed systems.T1505.003 · Web ShellThreat actors deployed web shells on exposed systems after chaining the flaws for unauthenticated remote code execution.

CVE

CVE-2026-105133The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.CVE-2026-105134The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.

Malware

XMRigSingapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.

Products

AhsayCBSSingapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.

Tools

XMRigSingapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.

Related Articles