The software that backs up a company’s files has become the way in. Security firm Huntress says attackers are actively exploiting two flaws in AhsayCBS, a backup management platform, to take over servers. The vendor’s latest release does not appear to be safe either.
What was found
According to Huntress, the National Vulnerability Database disclosed two vulnerabilities on 4 October 2026. They are tracked as CVE-2026-105133 and CVE-2026-105134. Exploitation began on 7 October, Huntress reports, shortly before midnight UTC.
The first flaw is rated medium severity. It sits in a password-check function and allows improper authentication. The second is rated critical and allows remote code execution. Huntress and BleepingComputer both describe attackers chaining the two. They use the first to get past authentication and the second to run code on the server.
One summary of the Huntress findings says the attackers gained SYSTEM-level privileges. That is the highest level of control on a Windows machine.
The patch problem
Both flaws were reported as fixed in AhsayCBS 10.3.2. Huntress first advised customers to update to 10.3.4. Then it revised its write-up. After further investigation, the company said version 10.3.4 is also affected. It said it had contacted Ahsay and shared its research.
BleepingComputer notes that 10.3.4 is the latest version available. At the time of the reports, then, there was no clearly patched release for administrators to move to. We could not confirm from the sources whether Ahsay has since issued a fix or commented publicly.
What the attackers did next
Huntress says it had seen five organizations targeted as of 8 October. Once inside, the attackers carried out reconnaissance and dropped JSP webshells. A webshell is a small script that gives an intruder a remote control panel on the server.
They also installed XMRig, a cryptocurrency miner that uses a machine’s processor to generate coins for the attacker. The miner was disguised as Microsoft Edge. It was saved as edge.exe and kept running through a Windows service called MicrosoftEdgeUpdateSvc. That service launched msedge.exe, which Huntress identified as a modified copy of a legitimate service-management tool, NSSM.
The attackers also dropped a PowerShell script, Taskgmr.ps1, that Huntress believes was written with help from AI. Its job is to hide the mining. When someone opens Task Manager, the script stops the miner. When Task Manager closes, it starts again. Huntress also described a rule that shuts Task Manager down if it stays open for too long in the middle of the night. This catches a lone administrator looking at a busy processor late at night.
Mining is a nuisance more than a catastrophe. But the same access could in principle be used for worse. A backup server typically holds copies of an organization’s data and has credentials to reach many other systems. Huntress’s reporting, as summarized, does not say any data was stolen, and we have no confirmation either way.
What administrators can do
- Take the console off the open internet. Huntress’s advice is to restrict access. Put the AhsayCBS management interface behind a VPN or an IP allow-list.
- Check your version. Treat 10.3.4 as vulnerable until Ahsay says otherwise, and watch the vendor’s advisories for a corrected build.
- Look for the signs. Search servers for a service named MicrosoftEdgeUpdateSvc, files called edge.exe or msedge.exe in unusual folders, and a script named Taskgmr.ps1. Also look for unfamiliar JSP files in the application’s web directories.
- Watch for slowdowns. Unexplained high processor use on a backup server, especially at night, is worth investigating even if Task Manager looks quiet.
- If you find a compromise, assume the credentials are exposed. Rotate passwords and keys stored on or reachable from the backup server, and rebuild the host rather than just deleting the miner.
- Keep offline copies. Make sure at least one backup set is not reachable from the same management console.
For smaller businesses and home users
Many small firms run backup tools through an outside IT provider. It is reasonable to ask that provider whether it uses AhsayCBS, which version, and whether the console is reachable from the internet. A one-line answer is enough to tell you if you are exposed.
The wider lesson is a familiar one. Tools that sit quietly in the background, such as backup, monitoring and remote management software, are attractive targets because they run with broad privileges and are often forgotten. Attackers also keep choosing names that look dull, like an Edge update service, to blend in.
Huntress’s findings are the main evidence here, and the five affected organizations are a count from one security vendor’s own customer visibility. The true number of compromised servers could be higher.