GajShield Threat Advisory — AhsayCBS Authentication Bypass and Command Injection (CVE-2026-105133 / CVE-2026-105134): Exploitation and XMRig Miner Coverage

Severity: Critical | Priority: 1

This GajIPS update adds detection for active exploitation of two vulnerabilities in AhsayCBS, a backup management platform widely used by managed service providers and system integrators. CVE-2026-105133 is an authentication bypass with a public exploit. CVE-2026-105134 is an OS command injection flaw. Attackers chain the two: they bypass authentication first, then inject commands that run on the server. 

Both flaws are reported as fixed in AhsayCBS 10.3.2, the latest release, is still affected. Treat every AhsayCBS server as vulnerable until the vendor confirms a working fix.

After getting in, the attackers:

• explored the system and installed JSP web shells for continued access;
• downloaded the XMRig cryptocurrency miner disguised as edge.exe;
• kept the miner running through a service named MicrosoftEdgeUpdateSvc, run by a modified copy of the NSSM service manager disguised as msedge.exe;
• ran a PowerShell script that stops the miner whenever Task Manager is opened and restarts it once Task Manager is closed, to hide the CPU usage;
• in at least one case, installed the vulnerable WinRing0x64.sys driver to squeeze more performance from the hardware.

If an exploitation alert triggers in your network, treat the AhsayCBS server as compromised:

• Look for JSP files you don't recognise in the web application folders.
• Check for a MicrosoftEdgeUpdateSvc service, and for edge.exe or msedge.exe outside the normal Microsoft Edge folders.
• Look for Taskgmr.ps1 and WinRing0x64.sys.
• Huntress advises restoring a compromised host completely from a known-good backup, because the attackers may have left other backdoors.
• AhsayCBS holds customer backups. Review which backup sets and credentials were reachable from the server, and tell affected customers if their data may have been accessed.