Your backup software is being used against you
If you run AhsayCBS as your backup server, you have a real problem sitting on your network right now. Two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, can be chained together to let an attacker log in without any credentials and run whatever commands they want on your system. Huntress confirmed active exploitation in October 2026. Attackers are already using this to plant web shells and XMRig cryptocurrency miners on exposed backup servers.
For a small or mid-size business, a compromised backup server is about the worst position you can be in. Backups are your last line of recovery after ransomware. If an attacker controls that server, they can delete your backups, exfiltrate your data, or use the machine to mine crypto on your electricity bill while you have no idea anything is wrong.
Why the first patches did not fix it
Ahsay released what they thought were fixes back in August 2026, in versions 9.15.2.59 and 10.3.4.0. The problem is those patches were incomplete. Exploitation was still possible on those builds. Huntress independently verified this. CISA added both CVEs to its Known Exploited Vulnerabilities catalog and set a federal patch deadline of October 17, 2026, which tells you how seriously the security community is treating this.
Ahsay has now published actual fixes. The versions that resolve the issue are AhsayCBS v10.3.4.45 and AhsayCBS v9.15.2.70, both labeled as hotfixes. Ahsay’s own guidance says to reboot your server after applying the hotfix, so do not skip that step.
This situation is a good reminder that patching is not always a one-and-done action. Veeam and Zyxel went through similar incomplete-patch cycles earlier this year, and the pattern keeps repeating: vendor releases a fix, researchers probe it, exploitation continues, vendor releases a second fix. If you patched in August and moved on, you are still exposed.
What to check right now
- Log into your AhsayCBS admin console and confirm your exact build number.
- If you are on any version below 10.3.4.45 or below 9.15.2.70, treat this as urgent, not next-week urgent.
- After patching, reboot the server as Ahsay instructs.
- Check for unexpected scheduled tasks, new user accounts, or unusual outbound connections, all common signs of a web shell or miner left behind before you patched.
If your AhsayCBS server is exposed to the internet without a VPN or firewall restriction in front of it, that is a separate conversation you need to have. Backup servers should not be publicly reachable in the first place. This is the same core issue we see with other management interfaces getting hit, like the Citrix NetScaler RCE cases from 2026 where exposed management surfaces turned into entry points.
The broader point about backup security
Backups get treated as infrastructure that just runs in the background, which is exactly why attackers target them. A backup server that nobody watches closely is an attractive pivot point. You want logging on that system, you want alerts if a new admin account appears, and you want the management interface off the public internet entirely.
According to The Hacker News reporting on this campaign, the attack chain achieves unauthenticated remote code execution, meaning an attacker needs nothing from you, no phished password, no insider access. Just an exposed port and an unpatched server.
Apply the hotfix, reboot, and then spend twenty minutes reviewing who has access to that system and whether it needs to be internet-facing at all. If you want a second set of eyes on your backup infrastructure or patch posture, Exine offers an IT assessment specifically for businesses that want to close gaps like this.
FAQ
What versions of AhsayCBS fix CVE-2026-105133 and CVE-2026-105134?
The confirmed fixes are in AhsayCBS v10.3.4.45 and v9.15.2.70, both released as hotfixes. Earlier versions, including 9.15.2.59 and 10.3.4.0 released in August 2026, did not fully resolve the vulnerabilities. Reboot your server after applying the hotfix.
Do I need to do anything after patching AhsayCBS?
Yes. Ahsay explicitly recommends rebooting the server after the hotfix. You should also review the system for signs of prior compromise, including unexpected user accounts, scheduled tasks, or unusual outbound network traffic, since exploitation was active before the fix was available.
Should my AhsayCBS server be accessible from the internet?
Generally no. Backup management interfaces should sit behind a VPN or firewall and never be directly reachable from the public internet. Restricting access significantly reduces your exposure even when unpatched vulnerabilities exist.
What is a web shell and why is it dangerous?
A web shell is a malicious script attackers upload to a compromised server. It gives them persistent remote access through a browser, often surviving reboots and patching if not specifically removed. On a backup server, that level of access is extremely serious.
