Ahsay has released new emergency hotfixes for two actively exploited AhsayCBS vulnerabilities after confirming that earlier updates did not completely eliminate the security weaknesses.
The flaws, CVE-2026-105133 and CVE-2026-105134, can be chained to bypass authentication and execute arbitrary commands on vulnerable backup servers. Attackers have already used the chain to install web shells and XMRig cryptocurrency miners.
Administrators who installed AhsayCBS 10.3.4.0 or 9.15.2.59 should not consider their systems protected. Ahsay now directs customers to deploy hotfix version 10.3.4.45 or 9.15.2.70 and reboot the server.
EARLIER PATCHES DID NOT FULLY CLOSE THE VULNERABILITIES
AhsayCBS 10.3.4.0 and 9.15.2.59 were initially believed to address the two vulnerabilities. Ahsay subsequently acknowledged that those releases did not fully fix the affected functions.
The corrected releases are:
- AhsayCBS 10.3.4.45 hotfix
- AhsayCBS 9.15.2.70 hotfix
Huntress independently tested version 10.3.4.45 and confirmed that it mitigates the initial entry point used in the observed attack chain. The researchers said that previous version 10 releases remained susceptible.
Ahsay instructs administrators to reboot affected servers after installing the appropriate hotfix.
ATTACKERS CHAINED TWO FLAWS FOR SYSTEM-LEVEL ACCESS
CVE-2026-105133 is an authentication weakness that allows an attacker to bypass normal access controls.
CVE-2026-105134 affects the AhsayCBS Replication Receiver interface and can provide remote command execution. When combined, the vulnerabilities allow an unauthenticated remote attacker to execute code with NT AUTHORITY\SYSTEM privileges on a Windows server.
Huntress began observing exploitation on October 7. At least five organizations were targeted in the activity documented by the security company.
After compromising vulnerable servers, attackers deployed Java Server Pages web shells into the AhsayCBS application directory. Those web shells provided continued command execution and were used to download additional malware.
WHY THIS UPDATE MATTERS
Backup-management servers are among the most sensitive systems in an enterprise or managed-service environment. They may store customer data, administrative credentials and recovery copies intended to restore operations after ransomware attacks.
The incomplete earlier fixes created a dangerous situation in which organizations could believe they were protected while attackers continued exploiting the same path.
Defenders should treat the replacement hotfix as an urgent correction and conduct compromise assessments on every system that remained exposed while running an earlier vulnerable or incompletely patched build.