🔍 AhsayCBS zero-days enable unauthenticated SYSTEM access on backup servers

Threat actors are exploiting two zero-day flaws in AhsayCBS to compromise exposed backup servers without credentials and execute commands as NT AUTHORITY\SYSTEM. The chain combines CVE-2026-105133 in checkSysPwd with CVE-2026-105134 in the Replication Receiver. Observed activity included JSP web shell deployment, reconnaissance, and XMRig miners disguised as Microsoft Edge.

The significance is the target set: centrally managed backup infrastructure with access to repositories, policies, replication, and admin functions. Even where observed use was cryptomining, compromise of internet-facing backup management can expose broader recovery operations and create persistence inside high-trust environments.

🛰️ Open sources - closed narratives
@sitreports