Attackers have been exploiting AhsayCBS since at least October 7, according to Huntress, and the federal deadline to patch arrives Saturday, October 17. CISA added the two flaws, CVE-2026-105133 and CVE-2026-105134, to its Known Exploited Vulnerabilities catalog on October 14. AhsayCBS is a backup management console used mainly by managed service providers, so one compromised server can reach many customer environments at once.
Huntress, the security firm that first reported the activity, says attackers chain an authentication bypass with a command-injection flaw to run code on the server without logging in. The chain runs as NT AUTHORITY/SYSTEM, which gives full control over the Windows host. The vendor's first patches did not close the gap, and a second hotfix arrived on October 12.
If you run this software, or depend on a provider that does, the practical questions are simple: which build is installed, and has anyone already been inside? The rest of this article answers both.
Why the October 17 deadline matters
CISA's October 14 addition makes Saturday the due date for federal civilian executive branch agencies. Under BOD 26-04, those agencies must treat the KEV entries as required fixes, according to Carthage Electronics' October 14 threat brief and Neoteo's summary of the four added flaws. For agency administrators, Friday is the last business day before the deadline.
The same CISA batch also included Palo Alto's PAN-OS flaw CVE-2026-0322 and Cisco Secure Email Gateway CVE-2026-76519. Both fit the edge-device pattern that has dominated recent disclosures. Palo Alto's PAN-OS zero-day and Cisco's second email gateway zero-day in a month both involved internet-facing hardware, and Ivanti's Connect Secure flaw was exploited for 12 days before a patch arrived.
AhsayCBS has drawn far less attention than recent Microsoft, Meta and FBI coverage. Its blast radius is larger than that attention suggests. A firewall protects one network. A backup console sits beside the data an MSP holds for many clients, so one unpatched server can expose a whole customer base.
How the two AhsayCBS flaws work together
CVE-2026-105133 is the authentication bypass. CISA-linked trackers score it 7.3 under CVSS 3.1. CVE-2026-105134 is the command-injection flaw in the Replication Receiver component. VulDB scores it 10.0, although some listings show 9.3. Scores vary by source, so plan around the higher figure until the vendor and CISA settle on one.
Both CVE records appeared in the US National Vulnerability Database on October 4, and their entries stated that a public exploit already existed. Exploit references were therefore in circulation before the first exploitation Huntress recorded at 23:20:15 UTC on October 7. That left defenders very little time between disclosure and attack.
Bitdefender's technical advisory, dated October 15, says its managed detection team has investigated multiple customer incidents through the same chain since about October 7. Huntress had counted at least five targeted organizations as of October 8. The post-exploitation activity it observed includes JSP webshells, a malicious replication receiver, a disguised Windows service and an XMRig cryptominer. The miner points to a financially motivated operator, not a quiet espionage tool.
The version picture shifted during the week. In its October 8 update, Huntress wrote, as Cyberunit quoted it: "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities." That conflicts with the CVE records, which list 10.3.0 through 10.3.2 as affected and 10.3.4 as unaffected.
One naming detail needs attention before you search. Some early coverage gave the authentication bypass as CVE-2026-105113. The identifier used by Huntress and CISA is CVE-2026-105133, and searching for the wrong number will miss advisories.
Which AhsayCBS vulnerability patch fixes the flaws
Ahsay has issued fixes in several rounds, so the build number matters more than the date of your last update. The vendor said on October 12 that its earlier patches did not fully fix the flaws. The current guidance by release line is below.
| Release line | Earlier build Ahsay says is not enough | Build to install now |
|---|---|---|
| v10 | 10.3.4.0 | 10.3.4.45 |
| v9 | 9.15.2.59 | 9.15.2.70 |
| v7 and v8 | Not named in sources reviewed | 9.15.2.70 |
The steps are the same for everyone: install the current build for your line, then reboot the server. Ahsay's guidance calls for a reboot after the update, so schedule one at the same time.
Because the version scope is still disputed, a conservative rule helps. Treat any 10.3.x build below 10.3.4.45 as exposed until the update is verified, even if a CVE listing says your build is unaffected. Hotfixes and build numbers can change faster than advisories do.
Ahsay's message to customers was blunt. The Hacker News reported that the vendor urged customers: "we strongly urge you to take immediate action" to secure environments and protect customer data.
Signs of compromise to check now
Patching closes the entry point, but it does not remove anything attackers left behind. Bitdefender's advisory makes the same point. Work through these checks on every AhsayCBS server, in roughly this order.
- Confirm the build number in the console, update to v10.3.4.45 or v9.15.2.70, and reboot.
- Look for child processes spawned by cbssvcX64.exe that resemble shells, scripts or downloaders.
- Check for replication receivers you did not create, and for JSP files in the application directory.
- Review admin accounts for names you do not recognize, and look for a Windows service disguised as legitimate software.
- Watch outbound connections to port 8029 and to known Monero mining pool addresses, which Rescana's report flags as indicators.
If any check turns up a webshell or cryptominer, treat the server as compromised. Rotate the credentials it held, and review which customer backups it could reach. A clean patch level does not answer either question.
Who is exposed through managed backups
US federal civilian agencies face the clearest deadline. US managed service providers and IT administrators running AhsayCBS carry the largest risk, because a compromised backup server can give attackers SYSTEM access and reach customer backups. Businesses and consumers whose provider runs unpatched AhsayCBS face indirect exposure, and most will have no visibility into which console holds their data.
The victim list is not public. No US-specific victim count has been confirmed in the sources reviewed. The "at least five organizations" figure reflects Huntress's own visibility and is not a census. Bitdefender's report of multiple customer incidents shows that other researchers have seen activity too, but it does not provide a total.
Attribution is unresolved. No source confirms whether one group runs the campaign, or whether it connects to the ransomware affiliates named in the FortiBleed advisory. FortiBleed is a separate campaign. The FBI and US Secret Service warned on October 6 that credential-harvesting attacks against FortiGate firewalls had compromised more than 86,000 devices in 194 countries, according to Cybersecurity Dive. Nothing in the sources reviewed ties the two campaigns together.
What to watch before and after the deadline
Three things bear watching over the next few days. The first is whether CISA adds a ransomware-use flag to the two entries. KEV trackers currently mark them "No" for known ransomware use, but that status can change. The second is whether Ahsay or independent researchers resolve the 10.3.4 scope question. The third is how attackers got in. Researchers have not confirmed whether the public exploits or internet scanning drove the activity.
Saturday's deadline will pass quickly. For agency administrators, it is a compliance date. For MSPs, the real work starts afterward: confirm every customer console's version, hunt for webshells that a patch will not remove, and tell customers what you found. New victim disclosures will most likely come from providers, since they can see their own consoles.
