A security patch for AhsayCBS backup servers failed to fully resolve two actively exploited vulnerabilities, prompting the vendor to issue an emergency hotfix.
Ahsay Systems confirmed on October 10, 2026, that version 10.3.4.0 had not adequately addressed CVE-2026-105133 and CVE-2026-105134. The company instructed affected version 10 partners to install hotfix 10.3.4.45 and reboot their servers.
Why the failed AhsayCBS patch matters
The failed update concerns managed service providers (MSPs), system integrators, and organizations using AhsayCBS to manage backup operations. Compromised management servers can expose sensitive configurations or provide access to other systems, depending on their privileges and network connectivity. Similar risks have emerged from vulnerabilities in Cisco firewall management systems.
In its October 10 security advisory, Ahsay acknowledged that the earlier patch was insufficient. Cybersecurity firm Huntress had already identified the problem, reporting attacks targeting five organizations as of October 8.
The figure represents targeted organizations, not necessarily five confirmed breaches. However, the observed activity confirms that attackers were exploiting the vulnerabilities in real-world environments.
How attackers exploit the AhsayCBS vulnerabilities
The vulnerabilities were disclosed on October 4, 2026. Initial National Vulnerability Database records identified version 10.3.4 as unaffected, but subsequent research contradicted that assessment.
CVE-2026-105133 is an improper authentication flaw in the checkSysPwd API function, assigned a CVSS 4.0 score of 5.5 by VulDB. CVE-2026-105134 is an operating system command-injection vulnerability in the Replication Receiver component, rated 9.3.
According to Huntress's technical investigation, attackers chained the vulnerabilities to bypass authentication and execute commands remotely with NT AUTHORITY\SYSTEM privileges. Researchers first observed exploitation on October 7 at 23:20 UTC.
Attackers deployed Java Server Pages (JSP) webshells and XMRig cryptocurrency miners disguised as Microsoft Edge executables. They also established persistence through a fraudulent Windows service, MicrosoftEdgeUpdateSvc, and used a PowerShell script, Taskgmr.ps1, to conceal mining activity when Task Manager opened.
How organizations can mitigate the risk
Ahsay's corrective hotfix, version 10.3.4.45, is available through its authenticated partner portal. Ahsay has released the corrective hotfix, although independent testing confirming that it fully resolves both vulnerabilities was not available in the sources reviewed.
Patching cannot remove malicious persistence from systems already compromised. Administrators should investigate earlier exposure, as highlighted by attacks involving compromised Zimbra servers, and take the following measures:
- Apply the corrective hotfix: Install version 10.3.4.45, reboot affected servers, and verify the running build.
- Restrict and segment access: Limit management interfaces to trusted IP addresses or VPN connections and isolate backup infrastructure.
- Audit replication and network activity: Investigate unauthorized receivers, configuration changes, and suspicious connections.
- Hunt for compromise: Examine unusual processes spawned by
cbssvcX64.exe, JSP webshells, and unfamiliar services. Preserve forensic evidence before remediation. - Secure credentials and recovery systems: Rotate potentially exposed credentials if compromise is suspected, verify backup integrity, and rebuild confirmed compromised hosts from trusted backups.
- Test incident-response plans: Exercise containment procedures, validate restoration capabilities, and confirm that teams can eliminate attacker persistence.
Huntress also published four Sigma detection rules and indicators of compromise to support investigations.
The bigger picture for backup security
Huntress documented webshell deployment and cryptocurrency mining but did not report ransomware deployment or confirmed backup-data theft in the incidents it investigated. Nevertheless, a compromise of centralized backup infrastructure can threaten an organization's recovery capabilities.
Maintaining reliable recovery capabilities requires both patched infrastructure and trustworthy backups. Organizations must also determine whether attackers retained access before the corrective update.
Read more: Federal warnings about rapid exploitation of newly disclosed vulnerabilities highlight how quickly attackers can target exposed systems before organizations complete remediation.