Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers

Active exploitation of two zero-day vulnerabilities in Ahsay Cloud Backup Server (CVE-2026-105133 — improper authentication; CVE-2026-105134 — command injection) has been observed; attackers chain the flaws to configure malicious replication receivers, deploy JSP web shells, and execute commands as NT AUTHORITY\SYSTEM. Observed payloads include XMRig cryptocurrency miners disguised as Microsoft Edge processes and persistence via a fake Edge update service; defenders are advised to inventory and isolate externally accessible AhsayCBS deployments, search for unexpected JSP files and suspicious cbssvcX64.exe child processes, restrict replication/management access to trusted networks, apply vendor fixes when available, and rebuild compromised hosts from known-good media.