Ahsay has released new hotfixes for its AhsayCBS backup software after confirming that patches shipped in August did not fully close two flaws attackers are exploiting. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14.
Two Chained Flaws Give Unauthenticated Remote Code Execution
CVE-2026-105133 and CVE-2026-105134 can be chained to bypass authentication and run arbitrary commands, which gives an unauthenticated attacker remote code execution on AhsayCBS versions 9 and 10. The product is a backup server, so the machines affected hold copies of other systems’ data.
Huntress reported earlier this month that attackers had chained the two flaws to deploy web shells and XMRig cryptocurrency miners on exposed systems. Web shells give attackers persistent remote access, while the miners consume server resources for the attackers’ profit.
The August Patches That Did Not Hold
Versions 9.15.2.59 and 10.3.4.0, released in August, were assumed to fix the flaws. Ahsay now confirms they did not fully do so. The company has issued new hotfixes, and a server reboot is required after applying them. Ahsay “strongly urges” customers to act immediately.
The admission means servers that installed the August releases and considered the issue closed were still exposed during the weeks in which attackers were using the chain. Ahsay has not said how long the incomplete fix was in place before it identified the gap beyond the early-October timing of Huntress’s report.
Huntress Verifies the Entry Point Fix in 10.3.4.45
Huntress independently verified that AhsayCBS version 10.3.4.45 mitigates the initial entry point of the chain. That entry point remained exploitable on earlier version 10 releases. The verification gives administrators a named build to target and a second opinion beyond the vendor’s own statement.
CISA Lists Both AhsayCBS Flaws in KEV With a Three-Day Deadline
CISA listed both CVEs in the KEV catalog with an October 17 remediation deadline for federal civilian agencies, a three-day window. The listing confirms active exploitation in CISA’s assessment. The sources do not say how many AhsayCBS servers are exposed online or how many have been compromised.
Backup Servers as a High-Value Target
A takeover of a backup server carries more risk than the loss of a single application server, because the backup system holds copies of data from the machines it protects. Attackers who plant web shells on such a host gain a position from which they could read stored backups. Huntress’s reporting describes web shell and cryptominer deployment, and it does not mention data theft from backups, so the sources document only the first two outcomes.
Why Huntress Verification Matters More Than the AhsayCBS Version Numbers
The second round was prompted by exploitation observed in the wild and not by the vendor’s own testing, based on the sequence reported. Organizations that track patch status by version number alone could have recorded AhsayCBS as remediated while it was still vulnerable, which is why Huntress’s confirmation of 10.3.4.45 matters more than the August version numbers.
Timeline of the Failed Fix
Ahsay released the first, incomplete patches in August. Huntress reported in-the-wild exploitation in early October. New hotfixes and the CISA KEV listing followed on October 14.
The three-step sequence leaves roughly two months in which the August versions were the vendor’s stated fix. Ahsay has not published figures on how many customers moved to those versions or how many remain on unpatched builds, so the share of installations still exposed is unknown. The company also has not said whether the hotfixes for version 9 close the same entry point that Huntress verified as mitigated in 10.3.4.45 on version 10. The hotfix requires a reboot, which means backup jobs running at the time of the update will be interrupted.
