The vulnerabilities in question are:

• CVE-2026-105133 (CVSS v4 score: 5.5) — an improper authentication vulnerability in the checkSysPwd() function within com/ahsay/obs/api/ApiStructsAction.java

According to reporting, the second flaw was also disclosed alongside this one, though specific details on its identifier were not provided in the source material. Attackers have been observed chaining these issues to take over devices, drop web shells for continued access, and deploy XMRig miners that are disguised as Microsoft Edge to evade detection.

Administrators running AhsayCBS should treat this as an urgent patching priority. Given the active exploitation in the wild, organizations using this backup solution should:

• Apply any available vendor patches or updates immediately
• Review systems for signs of compromise, including unexpected processes masquerading as Microsoft Edge
• Inspect for web shells and unauthorized scheduled tasks or services
• Monitor for unusual CPU usage that could indicate cryptomining activity
• Restrict network exposure of the AhsayCBS management interface where possible

The use of legitimate-looking process names like Microsoft Edge is a common defense evasion technique, so security teams should not rely on process names alone when hunting for malicious activity. File paths, parent processes, and network connections should all be examined.

Source: info@thehackernews.com (The Hacker News)

Has anyone in the community seen signs of this exploitation in their environment, or does your organization rely on AhsayCBS for backups?