Two chained vulnerabilities in AhsayCBS backup software are under active exploitation. Attackers are using the flaws to drop cryptominers renamed as Microsoft Edge. The vendor's stated patch does not work, leaving no software fix available as of October 12.
What the two CVEs do
CVE-2026-105133 (CVSS 5.5) is an improper authentication flaw in the checkSysPwd() function of AhsayCBS. It lets an unauthenticated attacker bypass the login gate entirely. CVE-2026-105134 (CVSS 9.3) is an OS command injection flaw in the Replication Receiver component. Chained together, the two vulnerabilities give unauthenticated remote code execution on any exposed AhsayCBS management interface.
What attackers do after getting in
Huntress observed exploitation starting October 7 and confirmed at least five affected organizations by October 8. The post-exploitation chain is consistent across victims: the attacker drops a web shell, runs reconnaissance, then deploys XMRig renamed as edge.exe, mimicking Microsoft Edge to blend into process lists. The installer script, Taskgmr.ps1, is suspected to have been written with AI assistance. It includes logic to pause mining when Task Manager is open and to terminate Task Manager if it remains open for more than an hour overnight.
The patch does not work
AhsayCBS version 10.3.4 was described by the vendor as the fix. Huntress confirmed it is also vulnerable. There is no working software remedy as of this writing. The only effective mitigation is network isolation: restrict the AhsayCBS management interface to trusted IP ranges or place it behind a VPN. Do not expose the management port to the internet under any circumstances.
Backup software is not safe software
The recurring pattern here is worth naming. Backup and recovery software sits at the intersection of high trust and low patching priority. Organizations often treat backup agents as infrastructure plumbing rather than attack surface. AhsayCBS, Veeam, ConnectWise ScreenConnect, and Backup Exec have all been exploitation targets in the past two years. If your backup management interface is internet-accessible, it is a target.
The specific wrinkle in this case is that cryptomining is the payload, not ransomware. The operators are earning from compute, not from data. That makes the attack quieter and easier to miss: no encrypted files, no ransom note, just a slow drain on compute and electricity until someone notices the GPU is running at 100 percent at 3am.
What to do right now
Check whether your AhsayCBS management interface is reachable on the public internet. If it is, firewall it immediately. Check running processes on backup servers for edge.exe in unexpected locations and for Taskgmr.ps1 in scheduled tasks. Review GPU or CPU utilization graphs for unexplained spikes during off-hours. Wait for a new vendor advisory before relying on any software patch; version 10.3.4 is not safe.