AhsayCBS vulnerability: timeline of an attack on backup servers
On October 8, 2026, Huntress reported that attackers are actively exploiting two flaws in AhsayCBS, the management console for Ahsay backup software. The product is mainly used by managed service providers (MSPs) and system integrators to run their clients’ backups. In other words, if your business hands its backups to a provider, the AhsayCBS vulnerability may affect you even if you’ve never heard the name.
One key point at the time of writing: according to Huntress, there is no patch yet, and version 10.3.4, first reported as safe, is also affected.
The timeline, hour by hour
Times converted to Eastern Time (ET) from Huntress data.
Both flaws published
The NVD publishes CVE-2026-105133 (authentication bypass, medium severity) and CVE-2026-105134 (unauthenticated remote code execution, critical).
7:20 p.m.
First attacks observed
Huntress sees attackers chaining both flaws: the first to get past authentication, the second to run commands with Windows SYSTEM rights.
Five organizations targeted
Attackers drop webshells (web backdoors), install the XMRig cryptominer disguised as Microsoft Edge and create a fake “MicrosoftEdgeUpdateSvc” service to stay in place.
6 p.m.
Important correction
Huntress confirms version 10.3.4 is also vulnerable, contrary to early reports, and says it has contacted Ahsay. Advice: restrict access to the console until a patch ships.
A telling detail: the “anti-Task Manager” script
Among the dropped files, Huntress found a PowerShell script, Taskgmr.ps1, that appears to be AI-assisted (judging by its comments). Its job: stop the miner as soon as someone opens Task Manager, then restart it once the window closes. It even kills Task Manager at 6 p.m. or if it stays open for more than an hour overnight. In one case, the attackers also loaded a legitimate but vulnerable Windows driver (WinRing0) to give the miner direct hardware access.
Mining sounds harmless. It isn’t: anyone who can run SYSTEM-level commands on your backup server can also, tomorrow, wipe or encrypt those backups.
Are you affected? Three questions
| Question | If the answer is yes |
|---|---|
| Do your backups run on Ahsay software (often resold under another brand by a provider)? | Ask your provider whether it uses AhsayCBS and which version. |
| Can the AhsayCBS console be reached from the internet? | It should be limited to trusted IP addresses or sit behind a VPN, as Huntress recommends. |
| Does the server show a “MicrosoftEdgeUpdateSvc” service or edge.exe / msedge.exe files in a Temp folder? | Huntress recommends a full re-image from a trusted backup, since attackers may have hidden other backdoors. |
The lesson for every business: your backups are a target
We think of backups as the safety net. To an attacker, they’re the first thing to knock out before ransomware. Three habits apply to any product, Ahsay or not:
- No admin console exposed to the internet. Backup, firewall, remote access: VPN or IP allow-list only. We saw it with FortiBleed and with exposed AI servers.
- One offline or immutable copy. At least one copy nobody, not even a hijacked admin, can delete for a set period.
- Clear questions for your provider. Which software, which version, who watches the console? Our list of questions to ask your web host applies here too.
At NeoTech, our automated 24/7 monitoring with on-call technician response is built to catch exactly this kind of abnormal behaviour (a backup service launching commands, a fake Edge process eating CPU). See also our cybersecurity services.
Book your free cyber check
Not sure which software protects your backups, or whether it’s visible from the internet? In a short meeting, we take stock and tell you what to fix first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (October 8, 2026, updated October 8 at 6 p.m. ET)
- SecurityOnline — AhsayCBS Vulnerabilities Exploited in Wild Attacks (October 2026)
Photo: Derrick Coetzee, Wikimedia Commons (CC0, public domain).