Your MSP Backup Console Got Webshells, Fake Edge XMRig, and a CISA KEV Stamp

AhsayCBS is the management console a lot of MSPs use to babysit client backups. CVE-2026-105133 (auth bypass) chains with CVE-2026-105134 (command injection on the Replication Receiver) into unauthenticated RCE as NT AUTHORITY/SYSTEM. Huntress saw exploitation start October 7, 2026. CISA added both CVEs to KEV on October 14 with a federal due date of October 17. The early “vendor patch does nothing” chapter is over. Hotfixes exist. If you are still on pre-hotfix builds with the console on the internet, you are not debating CVSS. You are debating how many .jsp files you want to find in webapps.

This is the updated picture as of mid-October 2026: active exploitation with webshells and cryptominers, vendor hotfixes that Huntress independently verified for the v10 entry point, and KEV. Our earlier coverage landed while the patch story was still on fire. The fire is now documented. Put the extinguisher on the server.

The chain, without the marketing gloss

NVD disclosed the pair around October 4, 2026. Huntress summarizes the combo cleanly:

• CVE-2026-105133: improper authentication in checkSysPwd (com/ahsay/obs/api/ApiStructsAction.java). Medium severity on its own. Door unlock.
• CVE-2026-105134: critical issue on /rps/api/json/UpdateReceivers.do in the Replication Receiver. Command injection / OS command execution path that can be reached after the bypass, landing as SYSTEM. CISA describes manipulation of the random parameter on that endpoint, chainable with 105133.

CISA KEV (added 2026-10-14):

• CVE-2026-105133: improper authentication; due 2026-10-17; forensic triage No
• CVE-2026-105134: command injection; due 2026-10-17; forensic triage Yes
• Known ransomware campaign use: Unknown for both

Huntress first saw exploitation at 2026-10-07 23:20:15 UTC. Within about a day they had multiple organizations in their customer base hit. Suspicious child processes from cbssvcX64.exe were the tell. That is the backup service spawning curl, PowerShell, and friends. Backup software should not be your cryptominer installer.

What attackers actually dropped (Huntress)

Post-exploitation was not subtle:

• JSP webshells dropped into the CBS web application directory after a malicious replication receiver config
• Payloads fetched from Alibaba Cloud OSS host imagefiles-backup.oss-ap-southeast-7.aliyuncs.com into Temp folders: Taskgmr.ps1, msedge.exe, edge.exe, config.json, and in at least one case WinRing0x64.sys
• XMRig miner renamed to look like Edge (edge.exe), talking to pool infrastructure on port 8029 (xmr.kryptex.network / reported IP 51.195.127.124)
• Persistence via a Windows service named MicrosoftEdgeUpdateSvc running a modified NSSM utility masquerading as msedge.exe
• Taskgmr.ps1: stops the miner service when Task Manager is open, restarts it when closed, kills Task Manager on a schedule. Huntress notes it looks AI-assisted (commented code energy). Cute. Still malware.

IOC table (from Huntress public write-up)

Huntress published Sigma rules covering unexpected children of AhsayCBS services, fake Edge binaries with daemonized flags, Task-Manager-aware service control scriptblocks, and WinRing0 downloads via command line. Steal those detections. Do not wait for your EDR vendor’s marketing blog.

The patch story, updated (this is why we rewrote)

Early reporting correctly flagged that AhsayCBS 10.3.4.0 was still vulnerable after initial confusion. Huntress updated on October 8 that 10.3.4 was affected and told people to lock down the management interface until a real fix landed.

Then the vendor moved:

• 2026-10-09: Ahsay says it began receiving partner reports of unauthorized access
• 2026-10-10: hotfix v10.3.4.45 for v10 partners
• 2026-10-12: hotfix v9.15.2.70 for v9; v7/v8 partners told to move to v9.15.0.0 then apply 9.15.2.70
• 2026-10-12 (Huntress): independently verified that 10.3.4.45 mitigates the initial entry point of the attack chain
• 2026-10-13: Ahsay publishes compromise indicators and rebuild guidance
• 2026-10-14: CISA KEV for both CVEs; due 2026-10-17

Ahsay’s October 13 status update states that hotfixes v9.15.2.70 and v10.3.4.45 fully address CVE-2026-105133 and CVE-2026-105134. That is the current vendor position. Patch, then hunt. Do not patch and high-five.

Ahsay’s own compromise tells

From Ahsay’s public guidance, treat the box as compromised if you see:

1. Strange folders on drive roots (examples they list: ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt) with same-day timestamps
2. Random-looking .jsp files or odd lowercase alphanumeric folders under %CBS%\webapps
3. Unauthorized RPS receivers
4. Unauthorized Admin-type AhsayCBS user accounts

Recommended recovery from Ahsay: full OS reinstall, install latest AhsayCBS (v9.15.0.0 or v10.3.4.0) plus the matching hotfix, restore Auto Save configuration from a timestamp that predates the compromise (they suggest at least one day before suspicious folder timestamps). Huntress independently says: if IOCs hit, full host re-image from trusted backup, because secondary backdoors are a thing.

What to do this week (not “next quarter”)

1. Inventory every AhsayCBS instance your MSP or enterprise runs. Version string. Public exposure. Who owns the change window.
2. Apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v9 path). Reboot if vendor guidance requires it for your build.
3. Lock management UI to VPN or allow-listed admin IPs. Forever, not just until the news cycle dies.
4. Hunt: children of cbssvcX64.exe / cbssvcX86.exe, MicrosoftEdgeUpdateSvc, Taskgmr.ps1, Edge-named binaries in Temp, JSP under webapps, unauthorized RPS receivers, new Admin users, Alibaba OSS egress to the host above.
5. If dirty: rebuild, do not “clean the jsp and hope.” Rotate credentials that lived on that box. Review what backup data and client secrets that console could reach.
6. Deploy Huntress Sigma (or equivalent detections) for the four post-exploitation patterns above.

Why MSP backup consoles are a recurring joke

Attackers love the tools MSPs leave on the internet: RMM, backup, remote support. One console, many tenants, SYSTEM privileges, weak network hygiene. Cryptominers are the loud, embarrassing symptom. Webshells are the quiet problem that survives your “we killed the miner” ticket. The industry will sell you another dashboard. Patching the console and removing it from the public internet is free relative to a multi-tenant incident.

Sloth take

We put the keys to everyone’s backups behind a web UI, skipped auth like it was optional, and then acted surprised when strangers installed XMRig named after a browser. CISA putting both bugs on KEV is not a plot twist. It is a late receipt. Hotfix. Rebuild the dirty ones. Stop exposing backup brains to the whole planet.

Need help hunting MSP-edge backup consoles without the vendor brochure? Book a slot with Dark Edge Consulting.

Sources

• Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (Oct 8, 2026, with Oct 12 hotfix verification update)
• Ahsay: AhsayCBS Vulnerability Status Update (Oct 13, 2026)
• CISA KEV entries for CVE-2026-105133 and CVE-2026-105134 (added 2026-10-14, due 2026-10-17)