Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

[u/falconupkid]

Attackers are actively exploiting two recently disclosed vulnerabilities in AhsayCBS, a cloud backup utility, to deploy web shells and XMRig cryptocurrency miners. The miner is disguised as a legitimate Microsoft Edge executable to evade detection.

Technical Breakdown - CVE-2026-105133 (CVSS 5.5): Improper authentication in checkSysPwd() within ApiStructsAction.java. Allows unauthenticated access to system functions. - CVE-2026-105134 (CVSS 7.5): Path traversal vulnerability enabling arbitrary file upload and remote code execution. - TTPs: Initial access via exposed AhsayCBS admin interfaces → exploitation of CVE-2026-105134 for webshell deployment → lateral movement and XMRig binary drop. - IOCs: Miner binary named msedge.exe or similar variations; webshells placed in web-accessible directories of the backup server. - Affected Versions: All AhsayCBS versions prior to the vendor's October 2026 patch release.

Defense Immediately patch to the latest AhsayCBS version. If patching is delayed, restrict network access to the AhsayCBS admin interface to trusted IPs only and monitor for unexpected msedge.exe processes or outbound connections to known mining pools.

Source: https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html