AhsayCBS Vulnerabilities Exploited to Deploy XMRig Miners

Cybersecurity researchers have reported that threat actors are actively exploiting two flaws in the AhsayCBS backup utility to compromise systems and deploy malicious payloads. The vulnerabilities include CVE-2026-105133, described as an improper authentication vulnerability in the checkSysPwd() function within the com/ahsay/obs/api/ApiStructsAction.java file, and a second flaw that together allow attackers to bypass authentication mechanisms. Once access is gained, attackers deploy web shells to maintain persistence and install XMRig cryptocurrency miners. The miners are reportedly disguised as legitimate Microsoft Edge processes to avoid detection. The attacks have been observed in the wild, affecting AhsayCBS systems globally. As of the report date, no specific patch has been detailed, though vendors recommend applying the latest secure updates and monitoring for indicators of compromise.