Attackers are exploiting two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, to take over servers and run an XMRig cryptominer renamed edge.exe so it looks like Microsoft Edge. Huntress reported that exploitation began on October 7, 2026 at 23:20:15 UTC and that it had seen five organizations targeted as of October 8. Those figures are Huntress’s own observations from its incident work, not an estimate of how many AhsayCBS servers are affected. Huntress’s October 8 update also says version 10.3.4 is affected, reversing its earlier statement. At the time of that update, no patch was available, so the practical advice is to restrict access to the management interface now and to check Ahsay’s advisories for a fixed release before you consider any host safe.
What Huntress observed
Huntress describes a multi-step intrusion that ends with a cryptominer running with SYSTEM privileges. In its account, the attackers first got past authentication, then used a second flaw to run code on the server. After that, they configured a malicious replication receiver, dropped a JSP webshell into the AhsayCBS application directory, and had AhsayCBS service processes launch commands that downloaded files into temporary directories. The payloads were then used to install and hide the miner.
As an Amazon Associate I earn from qualifying purchases.
Huntress’s timeline starts with the first observed exploitation on October 7, 2026 at 23:20:15 UTC. The count of five targeted organizations reflects only the cases Huntress itself saw as of October 8. Other organizations may have been hit without appearing in that count, and the report does not give a global figure.
How the two flaws are chained
The Huntress report describes the attack as a chain of two vulnerabilities. Neither should be read in isolation, because the authentication flaw matters mainly as the step that makes the second one reachable.
#1 Best Overall
CVE-2026-105133: improper authentication
CVE-2026-105133 is described as an improper-authentication issue involving the checkSysPwd function. In Huntress’s account, it allows the attacker to bypass authentication. The report does not say which AhsayCBS module or version range contains the function beyond the version statement covered below.
CVE-2026-105134: unauthenticated remote code execution
CVE-2026-105134 is a critical flaw in the Replication Receiver API endpoint /rps/api/json/UpdateReceivers.do. Huntress says it can enable unauthenticated remote code execution as NT AUTHORITY/SYSTEM. Because the endpoint is part of the externally reachable web application, anyone who can reach the management interface over the network may be in a position to attempt it. The report states that the exploit targets the externally accessible web app service on the host.
What the attackers installed
Huntress reports the following artifacts and behavior. These are observations from the incidents it investigated, and the report does not claim that every compromised host showed every component.
Free tools Windows power users keep installed
One-click scans. No signup required.
Malicious replication receiver and webshell
After exploitation, the attackers configured a malicious replication receiver and placed a JSP webshell in the application directory. That webshell gave them a persistent way back into the server, which is why Huntress recommends rebuilding compromised hosts rather than only removing the miner.
Fake Edge binaries and a service that mimics Edge Update
The miner was saved as edge.exe, a name meant to resemble Microsoft Edge. A modified NSSM service wrapper was saved as msedge.exe and registered as a service named MicrosoftEdgeUpdateSvc, designed to resemble the legitimate Edge Update service. Huntress says the service ran with SYSTEM privileges and kept the miner running. A helper file, config.json, was also downloaded, along with Taskgmr.ps1, the PowerShell script described below.
A script that hides the miner from Task Manager
According to Huntress, Taskgmr.ps1 watched for Task Manager. While Task Manager was open, the script stopped the mining service, and it restarted the service when Task Manager closed. Huntress also says the script could terminate Task Manager at particular local times. The effect is that a administrator who looks at Task Manager during a check may see no miner activity.
A vulnerable driver used for hardware access
In one incident, Huntress observed WinRing0x64.sys downloaded to a temporary folder. WinRing0 is a driver with known vulnerabilities, and Huntress says in this case it appeared to support the miner’s access to hardware. The report does not describe how the driver was loaded in every case, so treat its presence as a strong signal to investigate rather than a fully traced sequence.
Recommended Free Tools
Mining pool and network indicators
Huntress reported miner connections to an XMR mining pool on port 8029. The indicators it listed include the domain xmr.kryptex[.]network and the address 51.195.127[.]124:8029. The brackets are defanging, so remove them when you search logs or configure a firewall rule. The full report also lists further network indicators and payload hashes, which should be checked against your own telemetry rather than treated as a complete list of what an infected server will contact.
Use these indicators as investigation leads. A match on the pool address or port is strong evidence worth escalating, but the absence of a match does not clear a server, because attackers can change pools and addresses.
Version status: what is and is not established
The version guidance changed during the reporting period, so it needs careful reading. Huntress first said version 10.3.4 was not vulnerable. Its October 8 update says versions through 10.3.4 are affected and corrects the earlier statement. The update also says no patch was available at that point.
The available report does not identify a vendor-confirmed fixed version. Do not use a version number from a forum post or a vendor-independent summary to decide a host is safe. Check Ahsay’s own security advisories for a fixed release and confirm the exact build your server is running before you upgrade. Until a fixed build is confirmed and installed, treat every AhsayCBS server that exposes its management interface as exposed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to tell whether a server is compromised
Look for any of the following. A single hit is enough reason to investigate further.
Best Value
- AhsayCBS service processes launching unexpected child processes, particularly commands that download files.
- Replication receiver configurations you did not create.
- A JSP file in the AhsayCBS application directory that you cannot account for.
- Executables named
edge.exeormsedge.exeoutside Microsoft Edge’s installation directory. - A service named
MicrosoftEdgeUpdateSvcwhose binary is not Microsoft’s Edge Update component. Taskgmr.ps1,config.json, orWinRing0x64.sysin temporary folders.- Outbound connections to port 8029 or to the indicators listed above.
- CPU usage that appears and disappears when Task Manager is opened or closed.
Huntress’s report links four Sigma rules. They cover unexpected child processes from AhsayCBS, fake Edge-named binaries, Task Manager-aware service control, and WinRing0 downloads. Running them against your existing logs is a faster way to search than manual checks, though you should confirm the rules’ log sources are enabled on your servers before relying on a clean result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if your AhsayCBS server is exposed
- Restrict access to the AhsayCBS management interface web access. Huntress recommends allowing only trusted IP addresses or requiring VPN access. Do this first, since the report identifies the externally accessible web app service as the exploit target.
- Search the server for the indicators and artifacts listed above, starting with the AhsayCBS service’s child processes and the replication receiver configuration.
- If any indicator is confirmed, treat the host as compromised. Huntress says to reimage affected hosts from a trusted backup, because secondary backdoors may be present. Confirm that the backup predates the first exploitation on October 7, 2026, and that it does not contain the webshell.
- After rebuilding, apply the vendor-fixed version once Ahsay confirms it, and keep the management interface restricted until the fix is verified.
- Review logs for the same pool address and port across the network, not only on the affected server, since the miner can spread to other hosts reached through the same compromise path.
Comparing the defensive controls
There are no consumer product options to compare here. For defenders, the choices are how to restrict access and how to detect post-exploitation activity. The table shows what the Huntress report supports for each option. Where the report does not compare them, the cell says so.
| Control | What it reduces | Limits stated in the report |
|---|---|---|
| Trusted IP allowlist for the management interface | Exposure of the externally accessible web app to unknown sources | Not stated. The report does not compare allowlisting with VPN access. |
| VPN requirement for management access | Exposure of the management interface to the public internet | Not stated. The report does not assess VPN implementations. |
| Process lineage detection | Unexpected child processes launched by AhsayCBS services | Not stated. Depends on the Sigma rule and log source. |
| Masquerade detection (Edge-named binaries and service) | Fake Edge binaries and MicrosoftEdgeUpdateSvc |
Not stated. Depends on the Sigma rule and log source. |
| Script and Task Manager-aware service control detection | Taskgmr.ps1 behavior |
Not stated. Depends on the Sigma rule and log source. |
| Driver download detection (WinRing0) | WinRing0x64.sys in temporary folders |
Not stated. The driver was observed in one incident only. |
Scope and what remains open
The campaign picture comes from one detailed Huntress report, updated October 8, 2026. The details of the exploit chain and the artifacts are specific and consistent within that report, but they have not been independently confirmed by a second investigator in the sources available here. The version status, the number of affected organizations, and the availability of a fix are all changing. Check Huntress’s report and Ahsay’s advisories again before making a decision about a specific server.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAhsay’s security advisories are the authoritative source for remediation and fixed versions. The Huntress report remains the source for the incident observations, the indicators, and the Sigma rules, with the October 8 correction taking precedence over its earlier version statement.
The quotable line from the report is: “Organizations should restrict AhsayCBS management interface web access, as the exploit targets the externally accessible web app service on the host.” It is Huntress’s guidance and is not attributed to a named individual.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
