AhsayCBS: two chained flaws used to plant web shells, crypto miners and a backdoor on backup servers

How it happened

Huntress says the attackers chained CVE-2026-105133, an authentication bypass, with CVE-2026-105134, unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do on AhsayCBS servers.[1][2] Checked 11 Nov 2026

What was stolen

Not public yet Checked 11 Nov 2026

Who was impacted

Organisations running AhsayCBS servers that Huntress investigated, breached between October 8 and 11, 2026, before the hotfixes. Huntress does not give a number of affected servers.[1] Checked 11 Nov 2026

Threat actor

Not attributed

CVE

CVE-2026-105133, CVE-2026-105134

Timeline

1. 8 Oct 2026Huntress first reports exploitation of the AhsayCBS flaws. [1]
2. 11 Oct 2026End of the window, from October 8, in which the servers Huntress later investigated were breached, before Ahsay's hotfixes. [1]
3. 9 Nov 2026Huntress publishes its follow-up: five JSP web shell families, an XMRig miner dressed up as Microsoft Edge and a second miner restarted every minute by a SYSTEM scheduled task, Microsoft Defender exclusions, GOST and Chisel tunnels, AnyDesk, Atera and Splashtop, and a Python backdoor that runs a DLL in memory. It also saw a query consistent with a Veeam credential-theft module and says the incident "reflects a much larger intrusion with more patience" than a simple miner drop. It says hotfix 10.3.4.45 blocks the entry point. [1][2]