Threats Hide XMRig in Edge After Bypassing AhsayCBS Auth via Two Unpatched CVEs

Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup utility to seize control of affected devices. According to reports from SecurityWeek and The Hacker News, attackers are using these flaws to deploy web shells and install XMRig cryptocurrency miners. The miners are specifically disguised as Microsoft Edge processes to blend in with normal system activity and evade casual detection by security teams.

What vulnerabilities are being exploited?

The campaign targets CVE-2026-105133 and CVE-2026-105134. SecurityWeek reports that these flaws allow attackers to bypass authentication mechanisms and inject operating system commands. The Hacker News confirms that threat actors are leveraging these specific issues to gain unauthorized access. CVE-2026-105133 is identified as an improper authentication vulnerability located within the checkSysPwd() function.

How do the flaws function technically?

CVE-2026-105133 resides in the "com/ahsay/obs/api/ApiStructsAction.java" file. The Hacker News notes that this flaw carries a CVSS v4 score of 5.5. While the specific technical details for CVE-2026-105134 are not fully elaborated in the provided summaries, both vulnerabilities collectively enable remote command injection. This capability allows attackers to execute arbitrary OS commands on the compromised backup servers without valid credentials.

What is the impact of this exploitation?

Successful exploitation leads to the deployment of web shells on the affected systems. These shells provide persistent access for the attackers. Additionally, the threat actors install XMRig, a popular cryptocurrency mining tool. The Hacker News highlights that these miners are disguised as Microsoft Edge processes. This obfuscation technique aims to hide the malicious resource consumption from system monitoring tools and administrators who might overlook the familiar process name.

What is the current patch status?

No fix has been confirmed yet for these vulnerabilities. SecurityWeek describes the flaws as unpatched. Organizations running AhsayCBS should assume that their systems remain vulnerable to remote authentication bypass and command injection. Until the vendor releases an update, the risk of compromise remains high for any exposed instances of the backup software.

Background: Command injection

Prevent command injection by treating all user input as untrusted data. Use allowlists for permitted commands, avoid passing input directly to system shells, and prefer language-native libraries over shell calls. Validate input types strictly and escape special characters if shell execution is unavoidable.

Read the full guide: Command Injection Prevention: Secure Your Application Logic

What to do and how to stay safe: AhsayCBS

• Monitor system processes for XMRig instances disguised as Microsoft Edge or other legitimate applications.
• Review access logs for AhsayCBS to identify unauthorized authentication attempts or command injections.
• Isolate affected AhsayCBS servers from the network to prevent lateral movement or further data exfiltration.
• Once the vendor provides an update, apply the patch immediately to remediate CVE-2026-105133 and CVE-2026-105134.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the exploited AhsayCBS flaws?

The vulnerabilities are identified as CVE-2026-105133 and CVE-2026-105134.

How are the cryptocurrency miners hidden on the system?

The XMRig miners are disguised as Microsoft Edge processes to evade detection.

Is there a CVSS score available for these vulnerabilities?

CVE-2026-105133 has a CVSS v4 score of 5.5 according to The Hacker News.