We flagged AhsayCBS on Monday, when Ahsay said its first fix for two backup-server bugs fell short. Two things have changed since. Ahsay now has a hotfix for version 9 servers, and on Wednesday CISA added both bugs to its Known Exploited Vulnerabilities catalog with a federal deadline of Saturday, October 17.
Ahsay has also published what a compromised server looks like and how to rebuild one.
If your MSP runs your backups on AhsayCBS, ask them one question today: which hotfix are you on?
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
CISA adds the AhsayCBS bugs to its exploited list
The two bugs are CVE-2026-105133, an authentication bypass, and CVE-2026-105134, a command injection. Huntress, which found the attacks, saw them chained from October 7 to run code on exposed servers, drop web shells and install a crypto miner.
Ahsay’s October 13 status update lists the fixes: hotfix 10.3.4.45 for version 10, released October 10, and hotfix 9.15.2.70 for version 9, released October 12. Servers on v7 or v8 have to upgrade to 9.15.0.0 and then apply 9.15.2.70. Ahsay says both hotfixes “fully address” the two CVEs.
MSPs on AhsayCBS v7, v8, v9 and v10
Monday’s fix only covered version 10. Partners still on v9, or on the older v7 and v8, had no patch until October 12, and those older servers are the ones that tend to sit untouched.
AhsayCBS is mostly run by managed service providers, so one exposed server can hold the backups of many client companies. Ahsay’s advice for a compromised server is a full rebuild, which means the backup service may be down while it is reinstalled.
Apply the hotfix for your version, then check for the signs Ahsay lists
- Apply 10.3.4.45 on v10 or 9.15.2.70 on v9. On v7 or v8, upgrade to 9.15.0.0 first.
- Check each server for the four signs Ahsay lists (see Hunt / verify). Ahsay says one or more of them means the server is compromised.
- If it is compromised, follow Ahsay’s rebuild steps: reinstall the OS, install the latest AhsayCBS with the hotfix, and restore an Auto Save configuration from at least one day before the first suspicious file.
- If an MSP runs your backups, ask which version and hotfix they are on and whether they checked for these signs.
Forward this
For whoever manages our backups, or the MSP that does: CISA now lists the two AhsayCBS bugs as exploited, and Ahsay has hotfixes for both version 10 (10.3.4.45) and version 9 (9.15.2.70). Can you confirm which one we are on and that the server was checked against Ahsay’s compromise list?
Details
- CVE-2026-105133 (improper authentication) and CVE-2026-105134 (command injection): added to CISA KEV October 14, 2026; federal due date October 17, 2026.
- Fixes: v10 hotfix 10.3.4.45 (October 10); v9 hotfix 9.15.2.70 (October 12); v7 and v8 upgrade to 9.15.0.0, then apply 9.15.2.70.
- Exploitation: since October 7, 2026 (Huntress). Ahsay began receiving partner reports of unauthorized access on October 9.
Hunt / verify
- New folders at the root of the server’s drives with names such as ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user or opt.
- Randomly named .jsp files (for example 75bc584d292933ad.jsp) or short random folder names in the
%CBS%\webappsfolder. - Replication (RPS) receivers nobody on your team set up, and AhsayCBS user accounts with Admin privileges nobody created.
Slack paste: AhsayCBS CVE-2026-105133 + CVE-2026-105134 now on CISA KEV (due Oct 17). Action: v10 hotfix 10.3.4.45, v9 hotfix 9.15.2.70 (v7/v8 go to 9.15.0.0 first), check Ahsay’s four compromise signs, rebuild if any match.
Sources
- Ahsay: AhsayCBS Vulnerability Status Update (October 13, 2026)
- CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (October 14, 2026)
- Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
