AhsayCBS is the central management console for Ahsay's cloud backup software, used mainly by managed service providers (MSPs) and system integrators.

Two flaws were published on 4 October 2026 (CNA VulDB, with public exploit code): CVE-2026-105133, an authentication bypass in the checkSysPwd function of the API (CVSS 3.1 7.3), and CVE-2026-105134, an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (CVSS 3.1 10.0, CVSS 4.0 9.3), where a random token can stand in for valid credentials. The CVE records list versions up to 10.3.2 and point to 10.3.4 as the fix, but Huntress said on 8 October that 10.3.4 is also vulnerable and that it has told Ahsay.

Huntress first saw exploitation at 23:20 UTC on 7 October and had seen five organisations targeted by 8 October: attackers chained the two bugs to run code as NT AUTHORITY\SYSTEM, set up a malicious replication receiver, dropped a JSP webshell into the CBS web directory, ran reconnaissance, installed XMRig cryptominers disguised as Microsoft Edge, kept them running with a renamed NSSM service posing as Edge Update, loaded the vulnerable WinRing0x64.sys driver, and added an apparently AI-written PowerShell script that closes Task Manager if it stays open overnight. Primary: Huntress; wire: SecurityWeek.

UPDATE 14–15 October: Ahsay published an updated critical security alert saying its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully fix CVE-2026-105133 and CVE-2026-105134. Partners on v10 should apply the AhsayCBS v10.3.4.45 hotfix and partners on v7, v8 or v9 the v9.15.2.70 hotfix (both behind the partner portal), then reboot the server.

Huntress says it independently verified that 10.3.4.45 blocks the initial entry point of the attack chain. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 14 October with a 17 October deadline for US federal agencies. Wire: The Hacker News.