Short answer: Ahsay Backup has released new emergency hotfixes for AhsayCBS after admitting its August patches for two actively exploited vulnerabilities did not fully close the holes. If you run AhsayCBS, you need to apply the new hotfix and reboot your server now: CISA has added both flaws to its Known Exploited Vulnerabilities catalog with a federal patch deadline of October 17, 2026.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, a chained pair that lets attackers bypass authentication and execute arbitrary commands on affected backup servers. Security firm Huntress observed them being exploited in the wild earlier this month to drop web shells and XMRig cryptocurrency miners. This week brought two significant developments: the patches were incomplete, and the US government has now made fixing them mandatory.
What changed this week: new hotfixes, new deadlines
On October 15, 2026, Ahsay Backup published new security updates for AhsayCBS confirming that the fixes originally assumed to have landed in versions 9.15.2.59 and 10.3.4.0 (released in August 2026) did not completely plug the two flaws. The company is now urging every customer to take immediate action:
- AhsayCBS v10.3.4.45 hotfix (for v10 deployments)
- AhsayCBS v9.15.2.70 hotfix (for v9 deployments)
Ahsay’s guidance is blunt: apply the hotfix and reboot the server afterward. Huntress has independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the attack chain, which remained exploitable even on the supposedly patched v10 versions.
Why the first patches were incomplete
When the flaws were first disclosed in early October, the natural assumption was that the August updates had addressed them. That assumption turned out to be wrong. Attackers were still able to reach the vulnerable code path on systems running those versions, which is why exploitation continued even after organizations patched.
This is a pattern worth remembering: a patch that changes the vulnerable code but leaves an alternate path to the same function is still a vulnerability. Huntress’s verification of the new hotfix specifically calls out that the initial entry point is now mitigated, which is the detail admins should confirm when assessing their own exposure.
The attack chain, recapped
Huntress first reported on October 4 that threat actors were chaining CVE-2026-105133 (an improper authentication flaw in the checkSysPwd function) with CVE-2026-105134 (an OS command injection via the /rps/api/json/UpdateReceivers.do endpoint). We covered the initial wave of attacks in detail in our breakdown of the AhsayCBS zero-day exploitation, including the in-the-wild timeline that began on October 7.
To summarize how the compromise works:
- The authentication bypass lets an unauthenticated remote attacker reach privileged API endpoints.
- The command injection flaw then allows arbitrary operating system commands with no valid session.
- Attackers deploy JSP web shells, escalate to NT AUTHORITY\SYSTEM on Windows hosts, and install persistence.
- The payload of choice so far is XMRig cryptocurrency miners, disguised as legitimate processes such as edge.exe and msedge.exe, alongside service-based persistence and task-manager-evasion scripts.
The CVSS score for the chained flaws reaches 10.0, the maximum severity rating, and no workaround exists for versions that have not received the new hotfix.
CISA adds both flaws to the KEV catalog: Oct 17 deadline
The active exploitation has prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalog, which requires US federal agencies to apply the patches by October 17, 2026.
KEV listing matters for everyone, not just federal agencies. It is a strong signal that real-world exploitation is confirmed and ongoing, and private-sector security teams widely treat KEV deadlines as their own remediation targets. The October 17 date also coincides with the federal deadline for the actively exploited Palo Alto PAN-OS zero-day, making this week one of the heavier patch windows of the month alongside October’s 1,411-fix Patch Tuesday.
What to do right now
If you administer an AhsayCBS deployment, treat this as urgent:
- Check your version. Determine whether you run the v9 or v10 branch of AhsayCBS and note the exact build.
- Apply the new hotfix. Install v10.3.4.45 or v9.15.2.70, whichever matches your branch. Do not assume the August update was sufficient.
- Reboot the server. Ahsay explicitly requires a reboot after applying the hotfix; the mitigation is not complete until then.
- Look for signs of compromise. Review the server for unexpected web shells, unknown JSP files, unfamiliar Windows services, scheduled tasks, and miner processes masquerading as browser executables. If you find indicators of compromise, assume the host is fully compromised and follow your incident-response plan before simply re-imaging.
- Verify the entry point is closed. After patching and rebooting, confirm that the initial entry point Huntress described is no longer reachable from the network.
- Limit exposure. Backup management interfaces should not be reachable from the open internet. Restrict them to trusted management networks.
FAQ
I already patched AhsayCBS in August. Am I safe?
Not necessarily. Ahsay confirmed the August updates (9.15.2.59 and 10.3.4.0) did not completely fix the flaws. You need to apply the new October hotfix (10.3.4.45 or 9.15.2.70) and reboot your server.
What are the new AhsayCBS hotfix versions?
v10.3.4.45 for AhsayCBS v10 deployments and v9.15.2.70 for v9 deployments. Ahsay says to reboot the server after installing the hotfix.
Has Huntress confirmed the new fix works?
Yes. Huntress stated it has independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the attack chain, which remained exploitable on previous v10 versions.
What is the CISA deadline for the AhsayCBS flaws?
October 17, 2026. CISA added CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities catalog, which sets a binding remediation deadline for US federal agencies. Private organizations should treat the same date as their target.
What malware is being deployed through the AhsayCBS flaws?
Attackers are dropping web shells and XMRig cryptocurrency miners. The miners have been disguised as edge.exe and msedge.exe processes, with additional persistence through fake services and evasion scripts that hide mining activity from Task Manager.