Ahsay Backup, a Singapore-based vendor, has released new hotfixes for AhsayCBS after confirming that its August updates did not fully fix two flaws, CVE-2026-105133 and CVE-2026-105134. Chained together, they let an attacker bypass authentication and run arbitrary commands on the server. The Hacker News reports that attackers have used the chain to drop web shells and XMRig cryptocurrency miners on exposed systems.
Huntress described the exploitation in a report earlier this month. The flaws were first assumed fixed in AhsayCBS 9.15.2.59 and 10.3.4.0, released in August 2026, but Ahsay now says those patches did not completely close them. Huntress said it independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the attack chain, which was still exploitable on earlier v10 versions. CISA added the flaws to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by October 17, 2026.
How to check if you’re affected
Affected products are AhsayCBS backup servers on the v9 and v10 branches, including servers already updated to 9.15.2.59 or 10.3.4.0, which the vendor now says are not fully fixed. The sources do not say how far back vulnerable versions go, so check Ahsay’s announcement for your release.
- Install the hotfix for your branch: AhsayCBS v10.3.4.45 or v9.15.2.70. Ahsay says to reboot the server after applying it.
- Because exploitation is confirmed, treat a server that was reachable from the internet before patching as possibly compromised. Look for web shells you did not place and for an unfamiliar XMRig miner process or unexplained high CPU use.
- Huntress’s report is the place to find indicators of compromise; the sources do not list them here.
Sources
- Ahsay announcement: patch for CVE-2026-105133 and CVE-2026-105134
- CISA: adds four known exploited vulnerabilities to catalog (October 14, 2026)
- The Hacker News: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
- Huntress report on the AhsayCBS exploitation (cited by name; no direct link available)