AhsayCBS backup servers need a second patch after the first one fell short

If you or your managed service provider run AhsayCBS, the backup management console, the October 9 patch is not enough. Ahsay said on October 10 that version 10.3.4.0 “did not fully address” the two flaws attackers have been chaining since October 7, and told partners to install hotfix 10.3.4.45 and reboot.

Huntress, which found the attacks, had already warned that 10.3.4 was still vulnerable.

The backup server is the thing you restore from. It should not be the thing that needs restoring.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Ahsay says its first AhsayCBS fix fell short

Huntress saw exploitation start at 23:20 UTC on October 7 and counted five targeted organizations by October 8. The attackers chain CVE-2026-105133, an authentication bypass in the checkSysPwd function, with CVE-2026-105134, a flaw in the Replication Receiver API at /rps/api/json/UpdateReceivers.do that gives remote code execution as SYSTEM without a login.

After getting in, they set up a malicious replication receiver, dropped JSP web shells, installed the XMRig miner disguised as Microsoft Edge, created a fake MicrosoftEdgeUpdateSvc service, and loaded the vulnerable WinRing0 kernel driver. A PowerShell script hid the miner whenever Task Manager was open.

MSPs running AhsayCBS on the internet

AhsayCBS is mostly run by MSPs and system integrators, so one exposed console can hold backup jobs for many client companies. Huntress said the attack targets the externally reachable web service on the host.

Crypto mining is what Huntress observed. A web shell running as SYSTEM on a backup server allows a lot more than that.

Apply hotfix 10.3.4.45, reboot, and look for web shells

Install AhsayCBS hotfix 10.3.4.45 from the Ahsay partner portal and reboot the server.
Restrict the management interface to trusted IP addresses or put it behind a VPN, as Huntress recommends.
Check for the indicators below. If you find any, Huntress advises a full re-image from a trusted backup because the attackers may have left other backdoors.
If an MSP runs your backups, ask them which version they are on and when they rebooted.

Forward this

For whoever manages our backups, or the MSP that does: attackers have been breaking into AhsayCBS backup servers since October 7, and Ahsay says its first patch did not fully work. Can you confirm we are on hotfix 10.3.4.45, rebooted, with the console limited to trusted addresses?

Details

CVEs: CVE-2026-105133 (improper authentication, checkSysPwd, medium) and CVE-2026-105134 (Replication Receiver API, unauthenticated RCE as SYSTEM, critical). Published October 4, 2026.
Fix: AhsayCBS v10.3.4.45 hotfix (partner login required), then reboot. Ahsay: v10.3.4.0 “did not fully address” the flaws (October 10, 2026).
Exploitation: since October 7, 2026, 23:20 UTC; at least five organizations targeted by October 8 (Huntress).
Huntress Sigma rules: four post-exploitation rules in its threat-intel repository (2026/2026-10/AhsayCBS_XMRig_Miner).

Hunt / verify

Child processes of cbssvcX64.exe or cbssvcX86.exe outside normal startup, especially curl, certutil or PowerShell.
New .jsp files in the CBS web application directory, and replication receivers nobody on your team configured.
Taskgmr.ps1, edge.exe, msedge.exe, config.json or WinRing0x64.sys in Temp folders; a service named MicrosoftEdgeUpdateSvc.
Outbound traffic on port 8029, to xmr.kryptex[.]network, or to imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com.

Slack paste: AhsayCBS CVE-2026-105133 + CVE-2026-105134 exploited since Oct 7; Ahsay says 10.3.4.0 did not fully fix them. Action: install hotfix 10.3.4.45 + reboot, lock the console to trusted IPs/VPN, hunt for JSP shells and MicrosoftEdgeUpdateSvc.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].