Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

AhsayCBS Ships New Hotfixes After Exploited Flaws Survived August Patches

Two chained AhsayCBS flaws used to plant web shells and XMRig miners weren't fully fixed in August. Ahsay has released new hotfixes, and CISA has added both CVEs to KEV.

4T4Tify Team4Tify
Oct 15, 2026·4 min read
AhsayCBS Ships New Hotfixes After Exploited Flaws Survived August Patches

AhsayCBS Patched Again After Exploited Flaws Survived August Fixes

If you run AhsayCBS backup servers and patched in August, you may still be exposed. Ahsay Backup has shipped new hotfixes for two actively exploited vulnerabilities, CVE-2026-105133 and CVE-2026-105134, after confirming that its earlier patches did not fully close them.

What happened

  • The two flaws can be chained to bypass authentication and run arbitrary commands on an AhsayCBS server.
  • Huntress reported earlier this month that attackers were combining them to get unauthenticated remote code execution on internet-exposed servers, then dropping web shells and XMRig cryptocurrency miners.
  • Fixes in AhsayCBS 9.15.2.59 and 10.3.4.0 (August 2026) were thought to address the issues. Ahsay has now acknowledged they were incomplete.
  • New fixed builds: AhsayCBS v10.3.4.45 hotfix and AhsayCBS v9.15.2.70 hotfix. Ahsay says to reboot the server after applying the hotfix.
  • Huntress says it independently verified that 10.3.4.45 blocks the initial entry point of the attack chain, which earlier v10 builds were still open to.
  • CISA has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog and gave U.S. federal agencies until October 17, 2026 to patch.

Why it matters

Backup servers are high-value targets. They hold copies of a company's most important data, often run with broad privileges and are frequently reachable from the internet so remote agents can connect. A web shell on a backup server gives an attacker a persistent foothold. Today that foothold is being used for cryptomining, but the same access could be used to steal or tamper with backups, which are the safety net you depend on during a ransomware incident.

The bigger lesson is the patch gap: organizations that dutifully applied the August update may reasonably believe they are safe when they are not.

What to do

  1. Inventory: find every AhsayCBS instance, including MSP-hosted and forgotten test servers, and note the exact build.
  2. Patch now: upgrade to v10.3.4.45 hotfix or v9.15.2.70 hotfix, then reboot as the vendor instructs. Don't treat 10.3.4.0 or 9.15.2.59 as fixed.
  3. Reduce exposure: restrict the management interface to trusted networks or VPN where possible, and avoid exposing it directly to the internet.
  4. Hunt for compromise: patching does not remove an attacker who is already in. Look for unexpected web files or scripts in the AhsayCBS web directories, unfamiliar processes, sustained high CPU (a typical sign of miners), and outbound connections to mining pools.
  5. Check your backups' integrity: if you find signs of compromise, treat stored credentials and backup data on that server as suspect, rotate secrets, and confirm you have clean restore points.
  6. Track KEV: if you follow CISA KEV timelines, the federal deadline is October 17, 2026, and it's a sensible target for everyone else too.

Reported by The Hacker News (Oct 15, 2026); exploitation research by Huntress. Summary and guidance by the 4Tify Team.

SHARE