Attackers are chaining two AhsayCBS flaws into unauthenticated, SYSTEM-level remote code execution on backup servers, and the vendor's first fix did not stop them. The AhsayCBS vulnerability chain has been exploited since October 7, 2026, when Huntress began seeing activity at 23:20:15 UTC.
This is a continuing story, not a fresh breach, but the newest developments landed in the past week. On October 14, CISA added the flaws to its Known Exploited Vulnerabilities (KEV) catalog. The vendor's hotfix was still being verified and debated as of October 16 to 19.
The stakes are higher than a typical server bug. Backup servers hold credentials and recovery data. A compromise can expose what they store, and it can also weaken the restores a company depends on after a ransomware attack or another incident.
Why this AhsayCBS vulnerability chain matters now
AhsayCBS is a centralized backup-management console. Huntress says it is used primarily by managed service providers (MSPs) and system integrators. A single compromised console can therefore reach many customer environments, which turns one product flaw into a supply-chain problem. That is an inference from the product's user base rather than a measured count, but it explains why the bug matters beyond the companies that run it directly.
How the two flaws chain into SYSTEM-level access
The two bugs work in sequence. The first, CVE-2026-105133, is an improper authentication flaw in the checkSysPwd API function, which gives an attacker a way past the login check. The second, CVE-2026-105134, is an operating system command-injection flaw in the Replication Receiver component, which lets the attacker run commands on the host. Researchers describe the chain as an authentication bypass followed by command injection.
Once inside, attackers configured a malicious replication receiver and dropped a JSP webshell into the application directory that CBS serves. Some intrusions also deployed an XMRig cryptominer disguised as Microsoft Edge.
Public reporting still describes a small footprint. Rescana counted five organizations targeted as of October 8, and Bitdefender's MDR team investigated three suspected separate customer incidents tied to the chain. On October 9, Ahsay said partners had begun reporting unauthorized access to their AhsayCBS environments.
Huntress put the core problem plainly in a statement carried by SecurityOnline: "Huntress is seeing these two vulnerabilities being chained together in order to gain access to targeted systems."
Scores vary by source. VulDB rates CVE-2026-105133 at 5.5 under CVSS 4.0, and it lists CVE-2026-105134 at 10.0 under CVSS v3.1. Other sources put the command-injection flaw at 9.3, so check which figure an advisory uses before comparing severity across reports.
Why Ahsay's first fix did not hold
Ahsay's earlier notes said version 10.3.4.0, released August 4, 2026, addressed both flaws, according to Decryption Digest. Huntress disputed that claim. On October 10, Ahsay conceded that the release had not adequately addressed the vulnerabilities. In its announcements, the company wrote that the earlier patch "did not fully address" the problems.
Ahsay told affected version 10 partners to install hotfix 10.3.4.45 and reboot their servers. A separate hotfix for version 9, dated October 12, followed. Security Point Break covered that release as a second fix after the first attempt failed.
The public vulnerability record has also lagged. As of Monday, the NVD entry still lists version 10.3.4 as unaffected for both CVEs and describes an upgrade to 10.3.4 as the mitigation. Huntress says 10.3.4 is also affected. Anyone who relied on the NVD entry could believe they were covered when they were not.
Which AhsayCBS versions are affected and which builds to install
Ahsay's current remediation guidance covers deployments on versions 7, 8, 9 and 10. The fixed build depends on your branch.
| Branch | Affected per current guidance | Fixed build from Ahsay | Notes |
|---|---|---|---|
| v10 | Yes | 10.3.4.45 hotfix, dated October 10 | Install, then reboot the server |
| v9 | Yes | v9.15.2.70 hotfix, dated October 12 | Horizon3 lists it as fixed |
| v7 or v8 | Yes | Upgrade to v9.15.0.0, then apply v9.15.2.70 | Same v9 hotfix after the upgrade |
Two details complicate planning. Ahsay makes the hotfix available only through a partner portal login, which could slow remediation for smaller customers. The verification picture is also split. Horizon3 lists v9.15.2.70 as fixed, and Ahsay says it closes both flaws. Huntress's published independent verification covers only the version 10 entry point. Treat the broader v9 claim as the vendor's claim until more independent testing appears.
How to check your AhsayCBS version and clean up a server
Start with an inventory. Ask your IT team and any managed provider whether AhsayCBS runs anywhere in your environment, since it may sit inside a service you buy rather than on a server you manage. Then work through these steps:
- Confirm the full build number on every AhsayCBS server, not just the major version. 10.3.4 and 10.3.4.45 are different builds.
- Move version 10 installs to 10.3.4.45 or later, and reboot as Ahsay instructs.
- Move version 9 installs to v9.15.2.70 or later. Version 7 and 8 installs should upgrade to v9.15.0.0 first, then apply v9.15.2.70.
- Restrict the management interface to trusted IP addresses, as Huntress recommends.
- Search for unexplained JSP files in the webapps directory of the CBS install, unauthorized replication receivers, unknown administrator accounts, and a service named MicrosoftEdgeUpdateSvc.
Patching does not remove an intrusion that already happened. If you find any of those indicators, or cannot rule out compromise, Ahsay strongly recommends a full rebuild of the backup server. Rebuild from trusted backups. Web shells are a recurring tactic in self-hosted software, and USA 24 recently covered Nextcloud's CVE-2026-110447, where attackers could plant web shells in a similar way.
Who is exposed and what to watch next
The sources I reviewed do not include a US-specific victim count. Because AhsayCBS targets MSPs and integrators, US-based providers and their customers are a plausible exposure group, but that remains an inference until a count appears. Exploited edge and admin-tool bugs are showing up across the CISA catalog this month, and USA 24 covered a related case in PEERSTITCH malware reaching 500 FortiGate firewalls.
Federal agencies are bound by a separate directive. CISA says Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies, and it encourages other organizations to prioritize KEV entries through risk-based management, as Neoteo reported.
Several questions remain open. The total number of victims is unknown. No threat group has been named in the sources reviewed. The XMRig miner and webshells suggest opportunistic actors, but I could not confirm that. The hotfix access limits and the NVD discrepancy also remain unresolved.
Three signals will show whether this chain is closing. The first is whether NVD corrects its entry for 10.3.4. The second is whether independent researchers verify v9.15.2.70 beyond the version 10 entry point. The third is whether more victims or an attributed actor surface. Until then, treat any AhsayCBS server reachable from the internet as possibly compromised until it has been checked.
