What happened

• CVE-2026-105133 and CVE-2026-105134 in AhsayCBS can be chained to bypass authentication and execute arbitrary commands without credentials [S1].
• Huntress reports the chain was exploited to drop web shells and XMRig cryptominers on exposed systems [S1].
• Fixes shipped in 9.15.2.59 and 10.3.4.0 were incomplete [S1].
• Ahsay released hotfixes v10.3.4.45 and v9.15.2.70, which should be applied followed by a server reboot [S1].
• CISA added both flaws to KEV with a federal remediation deadline of 2026-10-17 [S1].
• The source does not publish file paths, command lines, hashes or network IoCs [S1].

Timeline

Detect

Shell spawned by AhsayCBS server process · EDR / Sysmon process creation (EventCode 1)

index=* (EventCode=1 OR tag=process) (ParentImage="*Ahsay*" OR ParentCommandLine="*Ahsay*" OR parent_process_path="*Ahsay*") (Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*/sh","*/bash","*/curl","*/wget") OR process_name IN ("cmd.exe","powershell.exe","pwsh.exe","sh","bash","curl","wget")) | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host ParentImage Image

FROM logs-* | WHERE event.category == "process" AND (process.parent.executable LIKE "*Ahsay*" OR process.parent.command_line LIKE "*Ahsay*") AND (process.executable LIKE "*\\\\cmd.exe" OR process.executable LIKE "*\\\\powershell.exe" OR process.executable LIKE "*\\\\pwsh.exe" OR process.executable LIKE "*/sh" OR process.executable LIKE "*/bash" OR process.executable LIKE "*/curl" OR process.executable LIKE "*/wget" OR process.name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget")) | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmd = VALUES(process.command_line) BY host.name, process.parent.executable, process.executable

A hit means: The AhsayCBS process started a command shell or download tool. This is consistent with the unauthenticated RCE chain being used [S1]. Treat the host as possibly compromised until the activity is explained.

XMRig miner execution · EDR / Sysmon process creation

index=* (EventCode=1 OR tag=process) (Image="*xmrig*" OR process_name="*xmrig*" OR CommandLine="*stratum+tcp*" OR CommandLine="*stratum+ssl*" OR CommandLine="*--donate-level*" OR CommandLine="*randomx*") | stats count min(_time) as first values(CommandLine) as cmd values(ParentImage) as parent by host Image

FROM logs-* | WHERE event.category == "process" AND (process.executable LIKE "*xmrig*" OR process.name LIKE "*xmrig*" OR process.command_line LIKE "*stratum+tcp*" OR process.command_line LIKE "*stratum+ssl*" OR process.command_line LIKE "*--donate-level*" OR process.command_line LIKE "*randomx*") | STATS count = COUNT(*), first = MIN(@timestamp), cmd = VALUES(process.command_line), parent = VALUES(process.parent.executable) BY host.name, process.executable

A hit means: A miner matching common XMRig traits is running. On an AhsayCBS server, this matches the reported post-exploitation payload [S1]. The search terms are generic XMRig traits, not IoCs from the source.

New script files written under the AhsayCBS install path · Sysmon file create (EventCode 11) / EDR file events

index=* EventCode=11 TargetFilename="*Ahsay*" (TargetFilename="*.jsp" OR TargetFilename="*.jspx" OR TargetFilename="*.war" OR TargetFilename="*.php" OR TargetFilename="*.aspx" OR TargetFilename="*.sh" OR TargetFilename="*.ps1") | stats count min(_time) as first values(TargetFilename) as files values(Image) as writer by host

FROM logs-* | WHERE event.category == "file" AND event.type == "creation" AND file.path LIKE "*Ahsay*" AND (file.path LIKE "*.jsp" OR file.path LIKE "*.jspx" OR file.path LIKE "*.war" OR file.path LIKE "*.php" OR file.path LIKE "*.aspx" OR file.path LIKE "*.sh" OR file.path LIKE "*.ps1") | STATS count = COUNT(*), first = MIN(@timestamp), files = VALUES(file.path), writer = VALUES(process.executable) BY host.name

A hit means: A new script or web-app file appeared under the AhsayCBS tree. This could be a web shell [S1]. The file types are inferred because the source gives no paths, so compare hits against the hotfix install time.

Verify

• Check whether the parent process is the AhsayCBS service and whether the child command line matches documented Ahsay maintenance, upgrade or backup scripts.
• Compare any new web or script files against a clean install of the same AhsayCBS version. Treat unexplained files written outside a patch window as suspect.
• Confirm a miner by sustained high CPU on the host and outbound connections to mining pools from the flagged process.
• Benign look-alikes include hotfix or upgrade activity that writes files and restarts services under the Ahsay path, and admin-run diagnostic shells.
• Pull AhsayCBS web access logs for the time window and look for unauthenticated requests that come just before the process or file event.

Scope

Affected

• AhsayCBS servers vulnerable to CVE-2026-105133 and CVE-2026-105134 [S1]
• AhsayCBS 9.15.2.59 and 10.3.4.0, whose earlier patches were incomplete [S1]

Only if

• The AhsayCBS server is reachable by the attacker; exploitation was observed on exposed systems [S1]

Not affected if

None stated by the sources.

Fixed in: Hotfix v10.3.4.45 (10.x) or v9.15.2.70 (9.x), followed by a server reboot [S1]

Enumerate

• All AhsayCBS instances, their exact version and hotfix level, and whether each has been rebooted since the hotfix
• Which instances are reachable from the internet
• Accounts and credentials stored in or used by AhsayCBS, including backup destinations, storage keys and service accounts
• Backup clients and data managed by each affected server

Contain

• Restrict internet access to AhsayCBS to known IPs or a VPN until the hotfix is applied and verified. This step is reversible.
• Preserve evidence before changing a suspect host: memory capture, disk image or snapshot, and AhsayCBS and web access logs.
• Apply hotfix v10.3.4.45 or v9.15.2.70 and reboot [S1]. Do not rely on 9.15.2.59 or 10.3.4.0 [S1].
• Isolate any host with a confirmed web shell or miner from the network.
• Rotate credentials held by AhsayCBS on compromised hosts. Rotation cannot be undone and will break dependent backup jobs until they are reconfigured.

Eradicate

• Remove web shells dropped through the RCE chain [S1].
• Remove XMRig binaries and any mechanism that relaunches them [S1]. The source does not describe the persistence method, so check services, scheduled tasks and cron.
• Close the root cause with the complete hotfix plus reboot [S1].

Recover

• Before restoring access, confirm the hotfix version and that a reboot has occurred [S1].
• Before restoring access, confirm no unknown files remain under the AhsayCBS install path.
• If integrity is in doubt, rebuild from known-good media rather than cleaning in place.
• Validate integrity of backup data managed by the server before relying on it for restores.
• Afterwards, monitor for child processes of AhsayCBS, CPU spikes, mining-pool connections and new web files.

Re-enter the loop when

• Huntress, Ahsay or CISA publish file paths, hashes or network IoCs.
• Ahsay revises the hotfix or reports these hotfixes are also incomplete.
• Exploitation is reported with payloads beyond web shells and miners, such as data theft or ransomware.
• Additional AhsayCBS versions or related Ahsay products are named as affected.
• A hunt hit appears on a host already marked patched.

Debrief

• Record each AhsayCBS instance's exposure, version, patch and reboot dates, and hunt results.
• Record whether 9.15.2.59 or 10.3.4.0 had been treated as fixed, and the patch-validation gap that created.
• Source gap: no IoCs, paths or command lines are published [S1].
• Source gap: the exploitation start date is not stated.
• Source gap: CVSS and exact vulnerable version ranges are not stated.
• Source gap: the KEV addition date is not stated.

Detection coverage — checked automatically

Checked automatically 2026-11-10 07:59Z from public sources: 16 published, 20 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-105133 — AhsayCBS flaws exploited for web shells and XMRig miners; incomplete patches fixed with new hotfixes; CVE-2026-105134 — AhsayCBS flaws exploited for web shells and XMRig miners; incomplete patches fixed with new hotfixes. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-105133

vuln:CVE-2026-105134

cpe:"cpe:/a:ahsay:cloud_backup_suite"

product:"Cloud Backup Suite"

host.services: (software.product = "Cloud Backup Suite")

http.title:"AhsayCBS"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 1 more affected product (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 07:59Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What are the vulnerable version ranges and CVSS scores for each CVE?
• When did exploitation begin, and did it begin before the incomplete patches?
• Did attackers access or tamper with backup data or stored credentials?
• Which file paths, web shell names, miner pools and attacker IPs did Huntress observe?
• Does the reboot requirement mean the hotfix is not effective until restart, and why?

Sources

• [S1] https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.