cybersecurity•Sun, October 18, 2026•4 min read

Critical AhsayCBS Vulnerabilities Under Active Exploitation: What MSPs Need to Know

Attackers are actively exploiting two severe vulnerabilities in AhsayCBS backup software to deploy webshells and cryptocurrency miners. Security teams must act immediately to secure their environments following reports of active breaches. Ahsay has issued urgent recovery guidance to mitigate these critical risks.

The High Stakes of Unpatched Backup Infrastructure

Managed Service Providers (MSPs) and enterprise IT departments are currently on high alert following the discovery of two chained vulnerabilities within AhsayCBS backup software. Attackers are weaponizing these flaws to gain unauthenticated access to backup consoles, allowing them to drop JSP webshells and install stealthy XMRig cryptocurrency miners on compromised systems.

The situation has escalated to the point that CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the severity of the threat. With initial patching efforts reportedly falling short in some instances, the focus has shifted toward more robust recovery procedures.

Understanding the Exploits: CVE-2026-105133 and CVE-2026-105134

The attack chain relies on two specific vulnerabilities that, when combined, grant attackers unauthorized control over the server. By chaining these flaws, malicious actors bypass authentication protocols to achieve Remote Code Execution (RCE) with SYSTEM-level privileges.

Unauthenticated Access: Attackers do not need valid credentials to initiate the exploit chain.
System-Level Control: Successful exploitation results in RCE, giving attackers full control over the backup server.
Persistence and Resource Theft: Attackers are deploying webshells for long-term access and XMRig miners to utilize the server's compute power for illicit crypto mining.

Recovery and Mitigation Steps

Given the reports of active exploitation—including multiple documented breaches—Ahsay has provided specific guidance for organizations. Simply applying a standard patch may not be sufficient in all cases due to the potential for persistence mechanisms already in place.

To ensure your infrastructure is secure, Ahsay strongly recommends a complete rebuild of the affected backup server. Relying on partial fixes in an environment where an attacker has already gained SYSTEM-level access is dangerous, as webshells can remain hidden even after the primary vulnerability is closed.

To ensure that your AhsayCBS backup server is completely free from any issues resulting from these security vulnerabilities, Ahsay strongly recommends performing a full rebuild of the backup server.
— Ahsay Backup Official Announcement

Key Takeaways

AhsayCBS backup servers are currently under active attack via two chained vulnerabilities.
Exploits allow unauthenticated attackers to gain SYSTEM-level RCE.
Malicious activity includes the installation of webshells and crypto miners.
CISA has added the flaws to its Known Exploited Vulnerabilities (KEV) catalog.
A full server rebuild is the recommended path for complete remediation.

FAQ

What software is affected by these vulnerabilities?

The vulnerabilities specifically affect AhsayCBS backup server software.

What is the primary risk of these exploits?

Attackers can gain unauthenticated remote code execution (RCE) with SYSTEM-level privileges, allowing them to install malware like webshells and crypto miners.

Why is a full rebuild recommended?

Because attackers may have already gained persistent access via webshells, a standard patch may not remove existing malicious backdoors. A full rebuild ensures the server is returned to a known-clean state.

Are these vulnerabilities being actively exploited?

Yes, reports indicate active exploitation has led to breaches across multiple organizations.