If you run AhsayCBS and believe 10.3.4 protects you from CVE-2026-105134, you are wrong, and the public CVE record is part of the reason. Huntress says attackers are exploiting the flaw, that 10.3.4 is affected too, and that no patch is available. The MITRE record, as of our check, says the opposite.

What is being exploited in AhsayCBS?

Huntress published its findings on October 8, 2026, under the title "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer." It saw exploitation starting at 23:20:15 UTC on October 7, and as of October 8 it had seen five organizations targeted.

RelatedCitrix NetScaler Zero-Days CVE-2026-88771/88772: Patch Now

Two bugs are chained:

  • CVE-2026-105133 (medium): improper authentication in the checkSysPwd function.
  • CVE-2026-105134 (critical): unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do.

Attackers pair the two to get code running as SYSTEM on the backup server. That is about the worst place to lose control of, since a backup service sits next to everything an organization wants to keep safe. For triage, our CVE watchlist now tracks both CVEs.

What do the attackers do after getting in?

Huntress described a fairly noisy toolkit. The post-exploitation steps it documented:

  • JSP webshells dropped into the application directory served by CBS.
  • An XMRig cryptominer renamed edge.exe.
  • A Windows service called MicrosoftEdgeUpdateSvc that runs a renamed NSSM binary (msedge.exe) as SYSTEM, which keeps the miner alive across reboots.
  • A PowerShell script, Taskgmr.ps1, that hides the miner by watching Task Manager and killing the process at set times.
  • The vulnerable kernel driver WinRing0x64.sys, loaded in one incident.

The naming is deliberate camouflage: Edge-flavored service and file names are easy to skim past on a server nobody logs into often. Webshells are the more serious find. A miner only burns electricity, but a webshell is a standing door that survives a miner cleanup.

Is AhsayCBS 10.3.4 vulnerable to CVE-2026-105134?

Yes, according to Huntress. In an update marked 10/8/26 at 6pm ET, it determined that Ahsay 10.3.4 is also affected, writing that "AhsayCBS versions up through 10.3.4 are affected by this issue." It says no patch is available, and that it contacted Ahsay and shared its research.

We checked the other side of the story at 03:38 UTC on October 12. The CVE records for both bugs were published on October 4, 2026 and last updated on October 5. Both still list 10.3.0, 10.3.1 and 10.3.2 as affected and 10.3.4 as unaffected. Both also tag Ahsay's 10.3.4 release notes as the patch reference.

Those release notes are dated 05-Aug-2026 and list no security fixes. Their bug fixes cover general items, backup destinations, Microsoft 365 and Proxmox VE. No version newer than 10.3.4 is listed. As of 03:38 UTC on Oct 12, Ahsay had not published a fixed version.

RelatedGoogle Fixes Actively Exploited Pixel Modem Flaw

How the record and the exploitation line up

  1. Aug 5AhsayCBS 10.3.4 released. Release notes list no security fixes.
  2. Oct 4Both CVE records published. 10.3.4 marked unaffected.
  3. Oct 7, 23:20 UTCFirst exploitation Huntress observed.
  4. Oct 8Huntress report, then the 6pm ET update. 10.3.4 declared affected.
  5. Oct 12Records still say 10.3.4 is unaffected. Checked at 03:38 UTC.

The CVSS scores in the records are not subtle. CVE-2026-105134 carries a CVSS 4.0 score of 10 (critical) and a CVSS 3.1 score of 10. CVE-2026-105133 is 6.9 (medium) under 4.0 and 7.3 under 3.1. Neither CVE is on the CISA Known Exploited Vulnerabilities list as of our check.

The scanner problem with a wrong CVE record

Vulnerability scanners and patch tools commonly read the CVE record's affected-version data. If that data says 10.3.4 is unaffected, an admin who upgraded to 10.3.4 will see a clean result and stop worrying. Meanwhile the researchers watching live attacks say that version is exposed. Treat a green scan on AhsayCBS 10.3.4 as unreliable until the record is corrected or the vendor ships a real fix.

What to do now

Huntress recommends restricting access to the AhsayCBS management interface to trusted IPs or a VPN, and investigating for compromise. If you find indicators, it says to fully re-image from a trusted backup, not just delete the miner.

Indicators from the Huntress report (defanged):

  • IPs: 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10, 123.202.208[.]37
  • Mining pool: 51.195.127[.]124:8029 and xmr.kryptex[.]network:8029

Also look for the MicrosoftEdgeUpdateSvc service, edge.exe and msedge.exe outside real Edge directories, Taskgmr.ps1, and unexpected .jsp files in the CBS application directory.

Primary sources