Ahsay walked back 10.3.4. The backup server is already in.

CVE-2026-105134 is unauth command injection as SYSTEM. Five orgs as of 8 Oct. The close is 10.3.4.45.

RWP Ventures · 2026-10-11 · event 2026-10-10 · 14 min read · priority 8.9

The version ticket changed overnight. NVD, published 4 October, still lists 10.3.0–10.3.2 affected and 10.3.4 unaffected. Ahsay’s 9 October clarification said v10.3.4.0 (released 4 August) “addressed” both CVEs and that upgraded partners “are no longer affected.” Huntress’s 8 October 18:00 ET update said 10.3.4 is in. On 10 October Ahsay published a second notice: “our previous patch v10.3.4.0 did not fully address” either CVE. The close Ahsay now names is partner-only hotfix v10.3.4.45, then a reboot.

Do not collapse four facts.

1. This is not on KEV. Catalog freeze retrieved this morning is still 2026.10.08 / 1739. Newest rows remain the five Integrity Tech Appendix B CVEs from [9 October](/posts/2026-10-09-integrity-tech-aa26-281a-kev/), due today, 11 October. CVE-2026-105133 and CVE-2026-105134 are absent. CISA-ADP SSVC on both NVD records, timestamped 5 October, still says exploitation: none. That predates Huntress’s first sighting by two days. Treat Huntress as the exploitation evidence, not the catalog.
2. 10.3.4.0 is not the close. The CVE records and Ahsay’s 9 October note told operators the August build was enough. Huntress disagreed. Ahsay’s 10 October alert agrees with Huntress on the product statement: 10.3.4.0 did not fully address either identifier. The named hotfix is 10.3.4.45, behind the partner portal.
3. A miner is not a clean bill for the backups. Huntress’s published cluster is resource hijacking: XMRig, a Task Manager-aware PowerShell hide, a fake MicrosoftEdgeUpdateSvc. Huntress has not claimed ransomware, backup deletion, or confirmed exfiltration in this campaign. SYSTEM on the box that holds MSP backup catalogs is still a compromise of the restore plane. Reimage if the IoCs are there; do not “kill XMRig and keep the CBS.”
4. This is not yesterday’s NetScaler and not Integrity Tech. [10 October](/posts/2026-10-10-netscaler-cve-2026-107406-saml/) was CVE-2026-107406 on Citrix. 9 October was AA26-281A. Different product, different mechanism, different actor (none named here).

What happened

AhsayCBS is the centralized management console for Ahsay backup software. Huntress’s audience sentence is the inventory sentence: MSPs and system integrators use it to create users, set policies, and run backups. The web app runs inside cbssvcX64.exe (or cbssvcX86.exe). That service is what Huntress first saw spawning unexpected children.

4 October. VulDB published both CVEs. NVD: 105134 is command injection via the random argument on /rps/api/json/UpdateReceivers.do in Replication Receiver, remotely exploitable, public exploit. 105133 is improper authentication in checkSysPwd in com/ahsay/obs/api/ApiStructsAction.java. Both records say upgrading to 10.3.4 resolves the issue. Affected versions named: 10.3.0, 10.3.1, 10.3.2. 10.3.4 listed unaffected. Ahsay’s 10.3.4 release notes are dated 5 August 2026 and do not name these CVEs.

7–8 October. Huntress: exploitation from 23:20:15 UTC on 7 October. Chain in the incidents they saw: 105133 to bypass authentication, then 105134 for code execution. After exploitation, a malicious replication receiver and a JSP webshell in the directory CBS serves. Five organizations by 8 October.

8 October 18:00 ET. Huntress update: 10.3.4 is also affected. Previous reporting (including the CVE records) had said it was not. Huntress contacted Ahsay. Until a patch, restrict the management interface.

9 October. Ahsay “Clarification on AhsayCBS v10.3.4.0 vulnerabilities”: both flaws “were addressed in AhsayCBS v10.3.4.0, released on 4 August 2026.” Upgraded partners “are no longer affected” and “protected against remote exploitation by unauthenticated attackers.” Separate, correct sentence: an upgrade does not remediate a server that was already compromised.

10 October. Ahsay “Critical Security Alert”: “our previous patch v10.3.4.0 did not fully address” CVE-2026-105133 and CVE-2026-105134. Partners on affected v10 should apply AhsayCBS v10.3.4.45 from the partner-only hotfix portal, then reboot. That portal redirects to Ahsay IdP login. It is not a public ISO.

BleepingComputer (9 October 13:17) and SecurityWeek are how most SOCs will have seen Huntress. The 10 October Ahsay alert is the vendor increment this morning.

Why it matters

Backup consoles are restore-plane infrastructure. An MSP CBS that is internet-reachable is a single unauthenticated RCE away from every tenant catalog it manages. That is true whether the follow-on in this cluster was XMRig.

Three operational lies are in the ticket this morning.

1. “NVD says 10.3.4 is unaffected, so we are out.” False as of Ahsay’s 10 October notice. The CNA record has not been updated (NVD last modified 6 October). The vendor has. Inventory against 10.3.4.45, not against the August 10.3.4.0 line the CVE page still prints.
2. “We only saw a miner, so the backups are fine.” False as a close. Huntress documented SYSTEM, a webshell, and a Windows service. Huntress has not published a census of backup-store integrity. Absence of claimed ransomware is not a forensic finding that nothing else was written.
3. “CISA has not listed it, so it is not exploited.” False on Huntress’s record. KEV is a catalog with a bar, not a denial. Integrity Tech’s five rows are due today; they are a different ticket.

An AhsayCBS in an industrial customer’s IT backup stack is still an IT backup-console problem on this record. No source in this assessment claims a process write, a PLC, or an OT protocol.

Who / what is affected

Huntress did not publish how many of the five were on 10.3.4 versus older 10.3.x. Do not infer a 10.3.4.0 exploitation proof from the version statement alone.

Technical context

RWP is not reproducing the random-argument injection or the authentication bypass. Huntress and the CVE records already give defenders the identifiers they need: the Replication Receiver JSON API, checkSysPwd, SYSTEM, and the post-exploitation cluster.

What Huntress published as observed post-exploitation, not as a how-to:

• Unexpected children of cbssvcX64.exe / cbssvcX86.exe (webshell commands surface as service children because the web app lives in the service).
• JSP dropped into the CBS web application directory.
• Downloads from Alibaba Cloud OSS imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com into %TEMP%: Taskgmr.ps1, msedge.exe, edge.exe, config.json, and in one incident WinRing0x64.sys via certutil.
• XMRig as edge.exe; modified NSSM as msedge.exe; service MicrosoftEdgeUpdateSvc running as SYSTEM; pool xmr.kryptex[.]network:8029 / 51.195.127[.]124:8029, miner user krxYMRN97D/creativejs.
• Taskgmr.ps1: stops the mining service while Task Manager is open, restarts it when Task Manager closes; kills Task Manager at local 18:00 or if left open more than an hour overnight. Huntress assesses the script as AI-assisted from commented code. That is assessment, not a second source.

Public hashes Huntress listed, for hunting:

Network infrastructure Huntress listed (not attribution): 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10, 123.202.208[.]37.

Huntress published four Sigma rules under 2026/2026-10/AhsayCBS_XMRig_Miner in its threat-intel repository: unexpected CBS service children; Edge-named binaries with --daemonized / NSSM original name; PowerShell that pairs Task Manager discovery with service stop/start; command lines that fetch WinRing0 plus a URL.

ATT&CK mapping from Huntress’s table, for the ticket:

This is not an exploitation guide.

Threat / exploitation status

Confidence on the CVE identifiers, Huntress exploitation window and five-org count as their telemetry, the 10 October vendor walk-back to 10.3.4.45, and absence from KEV: high. Confidence that every 10.3.4.0 on the internet is exploitable the same way Huntress described: moderate (Huntress version statement + vendor walk-back; no public independent retest cited here). Confidence that 10.3.4.45 closes both CVEs: moderate (vendor claim only; portal is partner-gated). Confidence that the campaign’s objective is only mining: moderate on Huntress’s published cluster, low as a general rule for SYSTEM on a backup server.

What defenders should do

1. Inventory every AhsayCBS — production, DR, lab, MSP-hosted tenant CBS. Record the exact build string. Treat anything below 10.3.4.45 as in, including 10.3.4.0. Do not close from the NVD “unaffected 10.3.4” row.
2. Pull the management interface off the internet. Huntress: trusted IPs or VPN. Ahsay did not offer a workaround that replaces the hotfix. Exposure of /rps/api/json/UpdateReceivers.do is the 105134 precondition Huntress named. Presence of the path on an affected build is exposure, not proof of compromise.
3. If you are an Ahsay partner: get 10.3.4.45 from the partner hotfix portal, apply it, reboot. The 10 October notice is explicit on the reboot. Snapshot and copy CBS logs off-box before the window. The hotfix page is behind IdP; there is no public anonymous download on that URL.
4. Hunt before you declare patched. Children of cbssvcX64.exe / cbssvcX86.exe that are not service start; unexpected .jsp under the CBS web root; MicrosoftEdgeUpdateSvc; edge.exe / msedge.exe in Temp; Taskgmr.ps1; WinRing0x64.sys dropped by certutil; the OSS host and hashes above. Huntress: if those IoCs are present, re-image from a trusted backup. A hotfix does not remove a webshell or a SYSTEM service.
5. Assume tenant blast radius if the CBS is an MSP console. Rotate credentials the console could have stored or relayed; verify backup-job integrity and restore tests from known-good media, not from the compromised CBS disk. Huntress did not claim backup deletion. SYSTEM means you cannot skip that check.
6. Keep yesterday’s clocks on the board. Integrity Tech KEV rows are due today. NetScaler CVE-2026-107406 still needs 14.1-73.46 / 13.1-64.29 for SAML IdP. This CBS ticket does not retire those.

RWP assessment

Score 8.9.

Highest-leverage development since yesterday’s NetScaler 107406 piece is confirmed unauthenticated SYSTEM on an MSP backup console, with the vendor spending 9–10 October reversing itself on the only build NVD still calls a fix. Evidence quality is high on Huntress (exploitation window, SYSTEM, IoCs, Sigma), on both Ahsay notices (the contradiction is in their own dates), and on the KEV JSON showing these identifiers absent. Evidence quality is intentionally split on remaining unpatched internet CBS population (no census) and on whether mining is the only objective (Huntress cluster vs what SYSTEM can do).

It outranks SonicWall SMA1000 CVE-2026-102255 (CVSS 10 WorkPlace SSRF, patched 6–7 October; Previdian honeypot attempts reported 9 October; SonicWall advisory still said no evidence at publication; not KEV) because Huntress has confirmed RCE and victim orgs, and because Ahsay’s 10 October hotfix is a same-weekend operator action. It outranks a second day on Integrity Tech because [9 October](/posts/2026-10-09-integrity-tech-aa26-281a-kev/) already assessed the seizure and the five-row add; today’s catalog is unchanged, and the due date is a clock, not new exploitation. It outranks a second day on NetScaler 107406 because yesterday already carried CTX697191, the CISA revision, and the 73.46 floor; overnight KEV did not add 107406. It outranks CISA ICS from 8 October (Red Lion, openPDC, Satel) because those advisories still report no known public exploitation.

What we are not saying: that either CVE is on KEV; that CISA has confirmed exploitation; that 10.3.4.0 is safe; that 10.3.4.45 has been independently verified here; that Huntress saw ransomware or backup wipes; that five organizations is the internet total; that a named crew is responsible; that a CBS in front of a plant is confirmed process impact.

What we are watching

• Whether CISA adds CVE-2026-105134 (and 105133) to KEV. That would be a material development.
• Whether NVD/CNA rewrite the 10.3.4 unaffected row.
• Whether Ahsay publishes a non-partner hotfix or a public checksum for 10.3.4.45.
• Whether Huntress, a CERT, or a second MDR raises the victim count or reports ransomware / backup destruction.
• Integrity Tech five-row KEV due today, 11 October.
• Apple CVE-2026-86950 due 13 October.
• SonicWall CVE-2026-102255: whether honeypot attempts become confirmed appliance compromise or a KEV row.

Sources

• Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• Ahsay — Critical Security Alert: CVE-2026-105133 and CVE-2026-105134 (10 October 2026)
• Ahsay — Clarification on AhsayCBS v10.3.4.0 vulnerabilities (9 October 2026)
• AhsayCBS v10.3.4 release notes (5 August 2026)
• Ahsay — partner hotfix portal (10.3.4.45)
• NVD CVE-2026-105134 · CVE-2026-105133
• CVE.org CVE-2026-105134 · CVE-2026-105133
• CISA KEV JSON catalog 2026.10.08
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — Unpatched AhsayCBS flaws exploited
• SecurityWeek — Unpatched AhsayCBS vulnerabilities exploited in the wild
• Huntress Labs threat-intel (Sigma: AhsayCBS_XMRig_Miner)
• [RWP — NetScaler 107406 Daily Top, 10 October 2026](/posts/2026-10-10-netscaler-cve-2026-107406-saml/)
• [RWP — Integrity Tech AA26-281A Daily Top, 9 October 2026](/posts/2026-10-09-integrity-tech-aa26-281a-kev/)