# AhsayCBS Vulnerability Chain Lets Attackers Seize Backup Servers

- URL: https://usa-24.com/ahsaycbs-vulnerability-exploited-backup-servers/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-19T18:25:19.722Z
- Updated: 2026-10-19T18:25:19.731Z
- Topics: Ahsay, Backup Security, Remote Code Execution, CISA KEV, Patch Management

> Attackers are chaining two AhsayCBS flaws into unauthenticated SYSTEM-level code execution on backup servers. Ahsay's first fix failed, and its replacement is still being verified.

## Key takeaways

- Exploitation of the AhsayCBS chain began October 7, 2026, at 23:20:15 UTC, according to Huntress.
- Ahsay confirmed on October 10 that version 10.3.4.0 did not adequately address CVE-2026-105133 and CVE-2026-105134.
- CISA added the AhsayCBS flaw pair to its Known Exploited Vulnerabilities catalog on October 14, 2026.
- Ahsay's current guidance names hotfix 10.3.4.45 for version 10 and v9.15.2.70 for versions 7 through 9.
- Huntress says version 10.3.4 is affected, while the NVD record still listed it as unaffected as of October 19.

Attackers are chaining two AhsayCBS flaws into unauthenticated, SYSTEM-level remote code execution on backup servers, and the vendor's first fix did not stop them. The AhsayCBS vulnerability chain has been exploited since October 7, 2026, when [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) began seeing activity at 23:20:15 UTC.

This is a continuing story, not a fresh breach, but the newest developments landed in the past week. On October 14, CISA added the flaws to its Known Exploited Vulnerabilities (KEV) catalog. The vendor's hotfix was still being verified and debated as of October 16 to 19.

The stakes are higher than a typical server bug. Backup servers hold credentials and recovery data. A compromise can expose what they store, and it can also weaken the restores a company depends on after a ransomware attack or another incident.

## Why this AhsayCBS vulnerability chain matters now

AhsayCBS is a centralized backup-management console. Huntress says it is used primarily by managed service providers (MSPs) and system integrators. A single compromised console can therefore reach many customer environments, which turns one product flaw into a supply-chain problem. That is an inference from the product's user base rather than a measured count, but it explains why the bug matters beyond the companies that run it directly.

## How the two flaws chain into SYSTEM-level access

The two bugs work in sequence. The first, CVE-2026-105133, is an improper authentication flaw in the checkSysPwd API function, which gives an attacker a way past the login check. The second, CVE-2026-105134, is an operating system command-injection flaw in the Replication Receiver component, which lets the attacker run commands on the host. [Researchers describe the chain](https://dev.to/iamfaizanakhtar/cve-2026-105134-ahsay-ahsaycbs-os-command-injection-rce-vulnerability-analysis-mitigation-201o) as an authentication bypass followed by command injection.

Once inside, attackers configured a malicious replication receiver and dropped a JSP webshell into the application directory that CBS serves. Some intrusions also deployed an XMRig cryptominer disguised as Microsoft Edge.

Public reporting still describes a small footprint. [Rescana](https://www.rescana.com/post/ahsaycbs-cve-2026-105133-105134-exploited-backup-console-rce) counted five organizations targeted as of October 8, and Bitdefender's MDR team investigated three suspected separate customer incidents tied to the chain. On October 9, Ahsay said partners had begun reporting unauthorized access to their AhsayCBS environments.

Huntress put the core problem plainly in a statement carried by [SecurityOnline](https://securityonline.info/ahsaycbs-vulnerabilities-exploited/): "Huntress is seeing these two vulnerabilities being chained together in order to gain access to targeted systems."

Scores vary by source. VulDB rates CVE-2026-105133 at 5.5 under CVSS 4.0, and it lists CVE-2026-105134 at 10.0 under CVSS v3.1. Other sources put the command-injection flaw at 9.3, so check which figure an advisory uses before comparing severity across reports.

## Why Ahsay's first fix did not hold

Ahsay's earlier notes said version 10.3.4.0, released August 4, 2026, addressed both flaws, according to [Decryption Digest](https://www.decryptiondigest.com/blog/ahsaycbs-cve-2026-105133-backup-exploit-chain). Huntress disputed that claim. On October 10, Ahsay conceded that the release had not adequately addressed the vulnerabilities. In its [announcements](https://www.ahsay.com/en/company/announcements?mdrv=www.ahsay.com), the company wrote that the earlier patch "did not fully address" the problems.

Ahsay told affected version 10 partners to install hotfix 10.3.4.45 and reboot their servers. A separate hotfix for version 9, dated October 12, followed. [Security Point Break](https://securitypointbreak.com/2026/10/12/ahsaycbs-vulnerabilities-second-hotfix/) covered that release as a second fix after the first attempt failed.

The public vulnerability record has also lagged. As of Monday, the NVD entry still lists version 10.3.4 as unaffected for both CVEs and describes an upgrade to 10.3.4 as the mitigation. Huntress says 10.3.4 is also affected. Anyone who relied on the NVD entry could believe they were covered when they were not.

## Which AhsayCBS versions are affected and which builds to install

Ahsay's current remediation guidance covers deployments on versions 7, 8, 9 and 10. The fixed build depends on your branch.

| Branch | Affected per current guidance | Fixed build from Ahsay | Notes |
|---|---|---|---|
| v10 | Yes | 10.3.4.45 hotfix, dated October 10 | Install, then reboot the server |
| v9 | Yes | v9.15.2.70 hotfix, dated October 12 | Horizon3 lists it as fixed |
| v7 or v8 | Yes | Upgrade to v9.15.0.0, then apply v9.15.2.70 | Same v9 hotfix after the upgrade |

Two details complicate planning. Ahsay makes the hotfix available only through a partner portal login, which could slow remediation for smaller customers. The verification picture is also split. [Horizon3](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/) lists v9.15.2.70 as fixed, and Ahsay says it closes both flaws. Huntress's published independent verification covers only the version 10 entry point. Treat the broader v9 claim as the vendor's claim until more independent testing appears.

## How to check your AhsayCBS version and clean up a server

Start with an inventory. Ask your IT team and any managed provider whether AhsayCBS runs anywhere in your environment, since it may sit inside a service you buy rather than on a server you manage. Then work through these steps:

- Confirm the full build number on every AhsayCBS server, not just the major version. 10.3.4 and 10.3.4.45 are different builds.
- Move version 10 installs to 10.3.4.45 or later, and reboot as Ahsay instructs.
- Move version 9 installs to v9.15.2.70 or later. Version 7 and 8 installs should upgrade to v9.15.0.0 first, then apply v9.15.2.70.
- Restrict the management interface to trusted IP addresses, as Huntress recommends.
- Search for unexplained JSP files in the webapps directory of the CBS install, unauthorized replication receivers, unknown administrator accounts, and a service named MicrosoftEdgeUpdateSvc.

Patching does not remove an intrusion that already happened. If you find any of those indicators, or cannot rule out compromise, Ahsay strongly recommends a full rebuild of the backup server. Rebuild from trusted backups. Web shells are a recurring tactic in self-hosted software, and USA 24 recently covered [Nextcloud's CVE-2026-110447](https://usa-24.com/nextcloud-cve-2026-110447-web-shells/), where attackers could plant web shells in a similar way.

## Who is exposed and what to watch next

The sources I reviewed do not include a US-specific victim count. Because AhsayCBS targets MSPs and integrators, US-based providers and their customers are a plausible exposure group, but that remains an inference until a count appears. Exploited edge and admin-tool bugs are showing up across the CISA catalog this month, and USA 24 covered a related case in [PEERSTITCH malware reaching 500 FortiGate firewalls](https://usa-24.com/peerstitch-malware-fortigate-firewalls/).

Federal agencies are bound by a separate directive. CISA says Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies, and it encourages other organizations to prioritize KEV entries through risk-based management, as [Neoteo](https://www.neoteo.com/en/cisa-added-four-exploited-flaws-to-the-kev-catalog) reported.

Several questions remain open. The total number of victims is unknown. No threat group has been named in the sources reviewed. The XMRig miner and webshells suggest opportunistic actors, but I could not confirm that. The hotfix access limits and the NVD discrepancy also remain unresolved.

Three signals will show whether this chain is closing. The first is whether NVD corrects its entry for 10.3.4. The second is whether independent researchers verify v9.15.2.70 beyond the version 10 entry point. The third is whether more victims or an attributed actor surface. Until then, treat any AhsayCBS server reachable from the internet as possibly compromised until it has been checked.

## Frequently asked questions

### Is AhsayCBS being actively exploited?

Yes. Huntress began seeing attackers exploit the two flaws on October 7, 2026, and Ahsay reported partner incidents starting October 9. CISA added the pair to its KEV catalog on October 14, which signals exploitation in the wild. Five organizations were targeted as of October 8, according to Rescana.

### How do I check my AhsayCBS version?

Confirm the full build number on each server, not only the major version, because 10.3.4 and 10.3.4.45 are different builds. Version 10 installs should be at 10.3.4.45 or later. Version 9 installs should be at v9.15.2.70 or later, and version 7 or 8 installs must first upgrade to v9.15.0.0.

### Does the AhsayCBS hotfix fully fix the vulnerabilities?

Ahsay says v9.15.2.70 closes both flaws, and Horizon3 lists it as fixed. Huntress's published independent verification covers only the version 10 entry point, so the broader v9 claim rests mainly on the vendor. A hotfix does not remove an existing intrusion, so check for compromise as well.

### What should I do if my AhsayCBS server may have been compromised?

Ahsay strongly recommends a full rebuild of the backup server. Look for unexplained JSP webshells, unauthorized replication receivers, unknown administrator accounts, and a service named MicrosoftEdgeUpdateSvc. Rebuild from trusted backups, and restrict the management interface to trusted IP addresses either way.

### How severe is CVE-2026-105134?

Scores differ by source. VulDB lists it at 10.0 under CVSS v3.1, while other sources rate it 9.3. It is an operating system command-injection flaw in the Replication Receiver component, and attackers have paired it with the authentication bypass in CVE-2026-105133.

## Sources

1. [Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer](https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
2. [Unpatched AhsayCBS Vulnerabilities Exploited in the Wild](https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/)
3. [Ahsay Confirms Failed Patch for Two Exploited Backup Flaws](https://www.esecurityplanet.com/news/news-ahsaycbs-patch-fails-two-exploited-vulnerabilities/)
4. [Announcements (AhsayCBS Vulnerability Status Update)](https://www.ahsay.com/en/company/announcements?mdrv=www.ahsay.com)
5. [CVE-2026-105133 & CVE-2026-105134: AhsayCBS](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/)
6. [Ahsay Issues Second AhsayCBS Fix After Earlier Patch Fails](https://securitypointbreak.com/2026/10/12/ahsaycbs-vulnerabilities-second-hotfix/)
7. [CVE-2026 KEV: Four flaws under attack](https://www.neoteo.com/en/cisa-added-four-exploited-flaws-to-the-kev-catalog)
8. [CVE-2026-105134: Ahsay AhsayCBS OS Command Injection RCE Vulnerability - Analysis & Mitigation](https://dev.to/iamfaizanakhtar/cve-2026-105134-ahsay-ahsaycbs-os-command-injection-rce-vulnerability-analysis-mitigation-201o)
9. [AhsayCBS Backup Console Under Active Exploitation](https://www.rescana.com/post/ahsaycbs-cve-2026-105133-105134-exploited-backup-console-rce)
10. [AhsayCBS Vulnerabilities Exploited in Wild Attacks](https://securityonline.info/ahsaycbs-vulnerabilities-exploited/)
11. [AhsayCBS CVE-2026-105133: Backup Console Exploit Active](https://www.decryptiondigest.com/blog/ahsaycbs-cve-2026-105133-backup-exploit-chain)