Backup Consoles Under Attack: Two AhsayCBS Flaws Are Being Exploited, and There Is No Patch Yet
Attackers are chaining two unpatched flaws in the AhsayCBS backup management console to run code without logging in. No fix exists yet, so limiting who can reach the console is the main defense.
Backup servers are supposed to be the safety net. This week, one widely used backup management platform became a target in its own right, and its vendor has not shipped a fix.
The situation in brief
AhsayCBS is a central console from Ahsay Systems for running cloud backup services. It handles backup policies, storage and user accounts, and it is a common choice among managed service providers and system integrators. Two flaws in it, tracked as CVE-2026-105133 and CVE-2026-105134, let an attacker tamper with arguments passed to certain functions. The result is an authentication bypass plus the ability to inject operating system commands.
The bugs became public on October 4. At that point NIST noted that exploit code was already out and that every AhsayCBS release up to 10.3.2 was affected. On Thursday, October 8, security firm Huntress reported that the flaws are being exploited in real attacks and that the newest release, 10.3.4, is vulnerable too. Huntress counted at least five targeted organizations as of that date.
Ionut Arghire covered Huntress’s findings for SecurityWeek, and the details below come from that report.
What the attackers did once inside
- Chained both bugs to run code remotely without credentials, then planted web shells on exposed servers.
- Abused an authentication bypass in the Replication Receiver component’s API, where a random token could stand in for valid credentials, to gain SYSTEM-level code execution, set up a malicious receiver and drop a JSP web shell into the application folder.
- Ran reconnaissance, then installed XMRig cryptocurrency miners named to look like Microsoft Edge.
- Added an AI-assisted PowerShell script that closes Task Manager if it stays open too long.
- Kept a foothold through a Windows service posing as Microsoft Edge Update, which launched a renamed copy of the legitimate NSSM service tool (msedge.exe) with SYSTEM privileges.
- In one case, loaded WinRing0x64.sys, a legitimate but vulnerable driver, so the miner could run with kernel-level access.
The guidance right now
Because there is no patch, Huntress’s advice centers on exposure. The attacks go after the web service the console exposes to the internet, so access to the management interface should be limited to trusted IP addresses or put behind a VPN. Organizations should also hunt for signs that their server has already been compromised.
What this means for your company
Even if you have never heard of AhsayCBS, your backups may run on it. Many small and midsize businesses buy backup as a service from a provider without knowing what software sits behind it. A cryptominer is the least of the worries here. An attacker with SYSTEM access on a backup server is close to the data you would need to recover from ransomware.
- Ask your backup provider directly whether they run AhsayCBS, whether the console is reachable from the internet, and what they have checked since October 8.
- Keep at least one copy offline or immutable so a compromised management server can’t reach every copy of your data.
- Watch for look-alike processes. An “Edge” process or service running on a server where nobody browses the web is worth a closer look.
- Treat any admin console as an edge device: no open internet exposure, access through a VPN or an allow-list, and alerts on new services and drivers.
- Test a restore. A backup you have never restored is a guess, not a plan.
Need help checking whether your backup platform is exposed, or setting up copies attackers can’t touch? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
