// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCVECVSS not assigned

AhsayCBS flaws exploited to deploy web shells and miners

An impacted organization's servers were exploited between Oct 8 and Oct 11, 2026, before Ahsay released hotfixes. Huntress disclosed the findings on Nov 9, 2026.

· 2 min read
AI-generated image of a technician inspecting backup servers beside a laptop in a dim server room.
AI-generated image, not a photo of the event.
Key takeaways
  • An impacted organization's servers were exploited between Oct 8 and Oct 11, 2026, before Ahsay released its hotfixes.
  • The intrusion deployed five web shell families, two miners, tunneling tools and a custom implant on backup servers.
  • Ahsay released hotfix 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 through 9.

Huntress said an impacted organization's servers were exploited between Oct 8 and Oct 11, 2026, before Ahsay released hotfixes. Attackers exploited CVE-2026-105133, an authentication bypass, and CVE-2026-105134, unauthenticated remote code execution as SYSTEM.

The intrusion reached servers used to hold backups. It deployed five web shell families, two miners, tunneling tools and a custom implant, giving the operators several components on systems that manage backup data.

AhsayCBS is the affected backup management platform. The Hacker News said the campaign delivered a Python-based implant and used XMRig miners, while evidence indicated the actor may have targeted servers holding or managing backups.

On this page

CVE-2026-105134 enabled SYSTEM-level remote code execution

CVE-2026-105133 was an authentication bypass. CVE-2026-105134 allowed unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do, Huntress said.

The Hacker News reported that the two vulnerabilities were assessed to have been weaponized as zero-days. It said the managed security platform first observed threat actors using a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners.

The operator used shells, miners and access tools on backup servers

Huntress found five web shell families, each with varying parameters and characteristics. The investigation also found two different miners, staged tunneling tools and a custom implant.

The Hacker News said the attack chain configured Microsoft Defender exclusions and served GOST, Chisel, AnyDesk, Atera and Splashtop. It reported that these tools were used to establish persistent access.

What happened

The researchers have not identified the malware family and did not observe the implant running. Its behavior after checking in is still unknown.

Huntress verified that hotfix 10.3.4.45 blocks the observed entry point. It said applying a hotfix mitigates the issue moving forward but does not remove files already planted on a compromised server.

Huntress has not identified the implant’s malware family or watched it run, so its behavior after checking in remains unknown.

What to do now

  1. Perform a full re-image from a trusted backup and rotate credentials stored on or reachable from the affected server, including credentials saved in AhsayCBS and backup software on the same network.

FAQ

What happened to AhsayCBS?

Threat actors exploited CVE-2026-105133 and CVE-2026-105134, deploying web shells, miners, tunneling tools and a custom implant before hotfixes were released.

Which AhsayCBS versions are affected?

Ahsay released hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for versions 7 through 9.

Were the AhsayCBS flaws exploited in the wild?

Yes. Huntress said the impacted organization’s servers were exploited between Oct 8 and Oct 11, 2026, before Ahsay released its hotfixes.

What malware did the AhsayCBS attackers deploy?

The intrusion included five web shell families, two miners and a custom implant. Huntress has not identified the implant’s malware family or observed it running.

How do I respond to a compromised AhsayCBS server?

Huntress recommends a full re-image from a trusted backup and rotating credentials stored on or reachable from the server, including those saved in AhsayCBS and backup software on the same network.

Sources

  1. Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant | Huntress, HuntressPrimary
  2. Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor, The Hacker News
  3. Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto, BleepingComputer
  4. Malware, Wikipedia
How we checked this story
ClaimSourceStatus
Huntress said attackers exploited CVE-2026-105133, an authentication bypass, and CVE-2026-105134, unauthenticated remote code execution as SYSTEM.HuntressConfirmed
Huntress said the impacted organization’s servers were exploited between October 8 and October 11, 2026, before Ahsay released its hotfixes.HuntressConfirmed
Ahsay released hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for versions 7 through 9, and Huntress verified that 10.3.4.45 blocks the observed entry point.HuntressConfirmed
Huntress found five web shell families during its investigation.HuntressConfirmed
The intrusion deployed two miners, tunneling tools and a custom implant on servers used to hold backups.HuntressConfirmed
Huntress did not identify the malware family or observe the implant running, so its behavior after checking in remains unknown.HuntressConfirmed
Huntress said patching closes the entry point but does not remove files already planted on exposed servers.HuntressConfirmed
The Hacker News reported that the attack exploited two now-patched AhsayCBS vulnerabilities to deliver a Python-based implant.The Hacker NewsAttributed
The Hacker News reported that the two vulnerabilities were assessed as weaponized zero-days and that attackers deployed web shells and XMRig miners.The Hacker NewsAttributed
The Hacker News reported that Ahsay Backup released patches for the two vulnerabilities in mid-October 2026.The Hacker NewsAttributed
The Hacker News reported that the operator configured Microsoft Defender exclusions and used tunneling tools and legitimate remote access software for persistent access.The Hacker NewsAttributed
The Hacker News reported that evidence indicated the threat actor may have targeted servers holding or managing backups.The Hacker NewsAttributed
BleepingComputer reported that threat actors were exploiting one critical and one medium-severity AhsayCBS vulnerability that was still unpatched.BleepingComputerAttributed
Malware is software intentionally designed to disrupt or destroy systems, leak private information, gain unauthorized access, or interfere with security and privacy.WikipediaConfirmed
huntress.com published its report on Nov 9, 2026.huntress.comConfirmed

Could not verify

  • Whether the vulnerabilities were exploited before October 8, 2026 is not established
  • How many AhsayCBS servers were affected is not established
  • Whether credentials were retrieved from the related Veeam server is not established
  • Whether data was exfiltrated through the web shell is not established
  • Whether the two vulnerabilities received CVSS scores is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok