AhsayCBS 10.3.4 reportedly affected by flaws used to deploy webshells and crypto miners
SecurityUnverifiedUpdated:
A report says the latest AhsayCBS 10.3.4 release remains affected by two vulnerabilities being used to bypass authentication, execute commands, and install webshells and cryptocurrency-mining software.
Two flaws chained to deploy webshells and a miner
BleepingComputer reported that attackers exploited CVE-2026-105133, an authentication-bypass flaw with a public exploit, and CVE-2026-105134, an OS command-injection flaw, in AhsayCBS.
Huntress reportedly observed the flaws chained to gain access, deploy JSP webshells, and download an XMRig cryptocurrency miner disguised as edge.exe. The report says the activity targeted at least five organizations and was observed on October 7.
The two flaws had been described as fixed in AhsayCBS 10.3.2, according to the report. No independently verified before-to-now comparison of affected organizations is available.
Researchers at Huntress reported that both flaws also affect AhsayCBS 10.3.4, the latest version, and that attackers chained them in activity observed on October 7 against at least five organizations.
Flaws described as fixed reportedly persist in the latest version
AhsayCBS is typically used by managed service providers and system integrators. The reported finding matters because the two flaws were described as fixed in an earlier release but were reportedly still present in the latest version, while a patch was not available at publication.
Sources
- BleepingComputerUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoRead source →