Executive Summary
In October 2026, threat actors exploited two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in Ahsay's AhsayCBS backup software to deploy web shells and XMRig cryptocurrency miners. The flaws allowed attackers to chain authentication bypass with remote code execution capabilities on exposed systems. Initial patches released in August 2026 were incomplete, prompting Ahsay to issue emergency hotfixes in versions 10.3.4.45 and 9.15.2.70. The active exploitation led CISA to add both vulnerabilities to the Known Exploited Vulnerabilities catalog with a mandatory October 17, 2026 remediation deadline for federal agencies.
This incident highlights the growing trend of cryptojacking attacks targeting enterprise backup infrastructure and the challenges of incomplete vulnerability remediation in critical business systems.
Why This Matters Now
Backup systems are increasingly targeted as high-value infrastructure, and incomplete patches create extended exposure windows that attackers actively exploit for cryptocurrency mining operations.
Attack Path Analysis
Attackers exploited authentication bypass vulnerabilities CVE-2026-105133 and CVE-2026-105134 in AhsayCBS backup systems to achieve unauthenticated remote code execution. They deployed web shells for persistent access and XMRig cryptocurrency miners for cryptojacking operations. The attack targeted exposed backup infrastructure, leveraging incomplete patches to maintain access and execute malicious payloads on compromised systems.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actors exploited CVE-2026-105133 and CVE-2026-105134 vulnerabilities in exposed AhsayCBS backup systems to bypass authentication and achieve unauthenticated remote code execution
Related CVEs
CVE-2026-105133
CVSS 7.3An authentication bypass vulnerability in AhsayCBS that can be chained with CVE-2026-105134 to achieve unauthenticated remote code execution.
Affected Products:
Ahsay AhsayCBS – < 9.15.2.70, < 10.3.4.45
Exploit Status:
exploited in the wildCVE-2026-105134
CVSS 10A remote code execution vulnerability in AhsayCBS that can be chained with CVE-2026-105133 to achieve unauthenticated remote code execution.
Affected Products:
Ahsay AhsayCBS – < 9.15.2.70, < 10.3.4.45
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Web Shell
Command and Scripting Interpreter
Bypass User Account Control
Resource Hijacking
Masquerading
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Security Framework
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing
Control ID: 500.14
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Asset Management and Patching
Control ID: Device Security
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical exposure through backup infrastructure vulnerabilities enabling cryptojacking attacks, requiring immediate patching of AhsayCBS systems and enhanced egress security controls.
Health Care / Life Sciences
HIPAA compliance violations from backup system compromises, with cryptojacking threats potentially disrupting patient data protection and medical service availability.
Financial Services
Regulatory compliance risks from backup system exploitation, cryptocurrency mining operations threatening transaction processing integrity and customer data security.
Government Administration
Federal agencies face CISA mandate for immediate patching by October 17, with backup infrastructure vulnerabilities exposing sensitive government data.
Sources
- AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patcheshttps://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.htmlVerified
- CISA Adds Four Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalogVerified
- Ahsay Security Patch Update for CVE-2026-105133 and CVE-2026-105134https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-updateVerified
- Attackers Exploit AhsayCBS Flaws to Deploy Web Shells and Cryptocurrency Minershttps://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this authentication bypass attack by limiting lateral movement from compromised backup systems and controlling egress paths for cryptocurrency mining operations. Network segmentation could reduce the blast radius and scope of cryptojacking activities across the infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF visibility and monitoring capabilities would likely detect unauthorized remote code execution attempts and anomalous activity patterns from compromised backup infrastructure endpoints
Control: Zero Trust Segmentation
Mitigation: Zero trust segmentation policies would likely constrain privilege escalation by limiting access scope to specific workload boundaries and preventing unauthorized elevation of system permissions
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely block or constrain lateral movement attempts from compromised backup systems to other network segments and critical infrastructure components
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely detect web shell deployment and constrain command and control communications through comprehensive traffic analysis and anomaly detection across cloud environments
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain unauthorized data exfiltration attempts by limiting outbound communication paths and blocking suspicious data transfer patterns from backup systems
Cryptocurrency mining operations would likely experience reduced effectiveness due to constrained network connectivity and limited resource access within segmented backup infrastructure environments
Impact at a Glance
Affected Business Functions
- Data Backup and Recovery Services
- Business Continuity Operations
- IT Infrastructure Management
- Customer Data Protection
Estimated downtime: 3 days
Estimated loss: N/A
Potential exposure of backup data including customer files, databases, and system configurations stored on compromised AhsayCBS systems. Web shell deployment allows persistent access to backup infrastructure and sensitive organizational data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) to detect and block exploit traffic targeting known CVEs like CVE-2026-105133 and CVE-2026-105134 before they reach vulnerable applications
- • Deploy Cloud Firewall (ACF) with egress filtering to prevent cryptocurrency miners and web shells from establishing outbound connections to mining pools and command infrastructure
- • Establish Zero Trust Segmentation to isolate backup systems and prevent lateral movement from compromised AhsayCBS instances to other network segments
- • Enable Multicloud Visibility & Control to detect anomalous interactions, repeated malformed requests, and suspicious automation patterns associated with exploitation attempts
- • Implement Threat Detection & Anomaly Response capabilities to baseline normal backup system behavior and alert on cryptocurrency mining processes and unauthorized remote access tools
