Attackers Exploit Two AhsayCBS Zero-Days for Unauthenticated Server Takeover

Threat actors are actively exploiting two zero-day vulnerabilities in Ahsay Cloud Backup Server to compromise exposed infrastructure. These intrusions allow attackers to execute commands with SYSTEM privileges without any form of authentication.

What happened

Threat actors are currently exploiting two zero-day vulnerabilities in Ahsay Cloud Backup Server to compromise exposed backup servers. According to GBHackers, these intrusions allow attackers to execute commands with SYSTEM privileges without requiring authentication. This unauthenticated access bypasses standard security controls, granting attackers full control over the affected systems.

Field Effect reported on October 9, 2026, that this exploitation campaign had already begun. The security firm highlighted that the attacks target the infrastructure that centrally manages backup operations. By compromising these central servers, attackers can potentially access a wide range of backed-up data and systems.

The observed intrusions have resulted in the deployment of web shells and cryptocurrency miners on the compromised servers. These malicious payloads indicate that attackers are seeking persistent access and resource exploitation. The use of web shells allows for continued remote control, while miners consume server resources for financial gain.

Why it matters

Compromising backup servers poses a significant risk to organizational data integrity and recovery capabilities. Backup systems are often treated as trusted environments, potentially lacking the same rigorous security controls as production servers. This trust model makes them attractive targets for attackers seeking high-value access.

The ability to execute commands with SYSTEM privileges means attackers have complete control over the operating system. This level of access allows them to modify, delete, or encrypt backup data. It also enables lateral movement to other connected systems within the network infrastructure.

The deployment of cryptocurrency miners suggests that attackers may be using these resources for long-term financial gain. However, the presence of web shells indicates a more immediate threat of data theft or further intrusion. The combination of these payloads highlights the severe operational impact of these zero-day exploits.

What to watch

• Monitor network traffic for unusual outbound connections that may indicate cryptocurrency mining activity.
• Check for unauthorized changes to system files or the presence of unknown web shells on backup servers.
• Review system logs for signs of unauthenticated access attempts or privilege escalation events.
• Assess the exposure of AhsayCBS instances to the internet and restrict access to trusted networks only.

Background: Privilege escalation vulnerabilities

Watch for unexpected access rights, process token anomalies, and file permission changes. Isolate affected systems immediately, audit group memberships, and review service account configurations to stop unauthorized privilege gain before it spreads.

Read the full guide: Spot Privilege Escalation Warning Signs Before Breach

What to do and how to stay safe: AhsayCBS

• Isolate exposed Ahsay Cloud Backup Server instances from the internet immediately to prevent further exploitation.
• Conduct a thorough forensic analysis of affected systems to identify the extent of the compromise and any deployed malicious payloads.
• Review and strengthen access controls for all backup infrastructure, ensuring that only authorized personnel can manage these systems.
• Monitor for vendor announcements regarding patches or mitigations for these zero-day vulnerabilities, and apply them once available.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Ahsay Cloud Backup Server?

Ahsay Cloud Backup Server is a software solution that centrally manages backup operations for organizations. It stores and manages backup data, making it a critical component of disaster recovery plans.

What are the two zero-day vulnerabilities being exploited?

The source material does not provide specific CVE IDs or technical details about the two zero-day vulnerabilities. It only states that they allow unauthenticated remote code execution with SYSTEM privileges.

When did the exploitation of these vulnerabilities begin?

According to Field Effect’s report dated October 9, 2026, the exploitation of these AhsayCBS vulnerabilities had already begun by that date. The exact start date of the campaign is not specified.