AhsayCBS backup server: login bypass and command flaws CVE-2026-105133, CVE-2026-105134 used in attacks
Attackers are chaining two flaws in Ahsay's AhsayCBS backup server to run commands without a password. Ahsay's first patches were incomplete. IT providers should install hotfix v10.3.4.45 or v9.15.2.70, reboot, and check for web shells and miners.
If you run AhsayCBS, or your IT provider does, install hotfix v10.3.4.45 (version 10) or v9.15.2.70 (versions 7 to 9) from Ahsay's partner portal, then reboot. Keep the admin console off the internet and have the server checked for web shells and miners since 4 October.
What’s happening
Two flaws in AhsayCBS, a backup management server run mostly by IT providers and businesses, are being chained in attacks. CVE-2026-105133 lets an attacker skip the login, and CVE-2026-105134 then lets them run operating system commands on the server. Security firms Huntress and Bitdefender saw attacks from about 7 October 2026, including web shells (hidden remote-control scripts) and a disguised cryptocurrency miner. Ahsay said on 12 October that its earlier patches, v10.3.4.0 and v9.15.2.59, did not fully fix the flaws, and released hotfixes: v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9, followed by a reboot. The hotfixes are obtained through Ahsay's partner portal. CISA listed both flaws as exploited on 14 October. Bitdefender saw no data theft or ransomware but called ransomware a plausible next step. Ahsay lists no workaround. Patching does not remove a web shell already planted, so servers exposed before the fix should be checked. The Ahsay page does not itself say the flaws are being exploited.
- What
- Flaw
- Affects
- Ahsay AhsayCBS backup management server (versions 7 to 10)
- Affected
- AhsayCBS v10 before v10.3.4.45 (including v10.3.4.0)
AhsayCBS v7, v8 and v9 before v9.15.2.70 (including v9.15.2.59) - Fixed in
- AhsayCBS v10.3.4.45 hotfix
AhsayCBS v9.15.2.70 hotfix - Since
- 4 Oct 2026
- Closed
- 15 Oct 2026
Timeline
- Update
Bitdefender reported three incidents it handled from about 7 October, with web shell, persistence and remote-access attempts that it blocked. It saw no encryption or data theft, and did not link the activity to one named group.
- CISA added
CISA added both flaws to its list of vulnerabilities being used in attacks.
- New fixFixed
Ahsay said its earlier patches (v10.3.4.0 and v9.15.2.59) did not fully fix the flaws, and released hotfixes: v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9. Both need a server reboot.
- Wider attacksNo fix yet
Security firm Huntress first saw the two flaws chained in attacks, and by 9 October had seen at least five organisations hit. Attackers dropped web shells and a hidden cryptocurrency miner. BleepingComputer reported that no patch was available for the affected versions at that point.
- Made publicNo fix yet
Both flaws were published in the US National Vulnerability Database, which noted that a public exploit existed, according to Bitdefender.
Sources
- Ahsay security alert: patch for CVE-2026-105133 and CVE-2026-105134 (update)Ahsay · 12 Oct 2026
- Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)Bitdefender · 15 Oct 2026
- Unpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoBleepingComputer · 9 Oct 2026