AhsayCBS Flaws Exploited for XMRig Miner Deployment

Threat actors are actively exploiting two recently disclosed vulnerabilities within the AhsayCBS backup utility, a software solution designed for enterprise data protection and disaster recovery. These exploits allow attackers to gain unauthorized control over affected devices, subsequently deploying malicious web shells and XMRig cryptocurrency miners. The primary objective appears to be the illicit mining of Monero (XMR) cryptocurrency, leveraging the compromised computing resources of victim organizations.

The vulnerabilities targeted are identified as CVE-2026-105133 and CVE-2026-105134. CVE-2026-105133, rated with a CVSS v4 score of 5.5, stems from an improper authentication flaw within the checkSysPwd() function located in the "com/ahsay/obs/api/ApiStructsAction.java" file. This specific vulnerability allows for potential bypass of authentication mechanisms, granting attackers access to sensitive system functions. The second vulnerability, CVE-2026-105134, is described as a path traversal vulnerability, which could enable attackers to access or modify files outside of the intended directory structure. The exact CVSS score for CVE-2026-105134 was not immediately available in the initial reporting, but path traversal flaws are typically considered critical due to their potential for arbitrary file access and manipulation.

Security researchers have observed that the malicious payloads are often disguised as legitimate Microsoft Edge browser processes, a tactic designed to evade detection by security software and system administrators. This obfuscation technique aims to blend the mining activity with normal system operations, making it more challenging to identify and remediate the compromise. The use of XMRig, an open-source cryptocurrency miner, is common in such attacks due to its efficiency and ability to run on various operating systems. The attackers are reportedly using the compromised systems to perform the computationally intensive work required for Monero mining, with the profits directly benefiting the threat actors.

AhsayCBS is a product developed by Ahsay Ltd., a company specializing in backup and disaster recovery solutions for businesses. The software is used by numerous organizations to safeguard their critical data against loss and ensure business continuity. The exploitation of these vulnerabilities poses a significant risk to organizations relying on AhsayCBS for their backup needs, potentially leading to data integrity issues, system performance degradation due to mining operations, and unauthorized access to sensitive information. The attackers' ability to deploy web shells further exacerbates the risk, as these can serve as backdoors for persistent access and further malicious activities, including data exfiltration or lateral movement within the victim's network. The disclosure of these flaws highlights the ongoing threat landscape for enterprise software and the importance of timely patching and security updates.