"Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customer's data," Ahsay said. "After applying the hotfix, please reboot your server."
CVE-2026-105133 and CVE-2026-105134: a paired chain that bypasses authentication
Two vulnerabilities in Ahsay Backup's AhsayCBS product — CVE-2026-105133 and CVE-2026-105134 — have been shown in the wild to be combined by attackers to sidestep authentication and execute arbitrary commands on exposed systems. Huntress reported earlier this month that threat actors are using the two flaws together to achieve unauthenticated remote code execution, enabling the deployment of web shells and XMRig cryptocurrency miners on vulnerable servers.
AhsayCBS hotfixes: v10.3.4.45 and v9.15.2.70 replace incomplete August patches
Ahsay Backup initially issued updates in August 2026 — AhsayCBS versions 9.15.2.59 and 10.3.4.0 — that were assumed to address the problems. The company has since confirmed those releases did not completely plug the holes. New hotfixes are now available: AhsayCBS v10.3.4.45 and AhsayCBS v9.15.2.70. In its advisory, Ahsay urged immediate application of the hotfix and required a server reboot after installation.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHuntress verification and observed payloads: web shells and XMRig miners
Huntress, which first reported active exploitation, said it observed threat actors chaining the two CVEs to gain unauthenticated RCE and subsequently deploy web shells and XMRig cryptocurrency miners. In an update, Huntress stated it has "independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point of this attack chain, which was still susceptible on previous v10 versions."
CISA response: KEV listing and an October 17, 2026 federal deadline
The active exploitation prompted the U.S. Cybersecurity and Infrastructure Security Agency to add CVE-2026-105133 and CVE-2026-105134 to the Known Exploited Vulnerabilities (KEV) catalog. That designation carries a requirement for federal agencies to apply the provided patches by October 17, 2026.
What this means for technologists, federal agencies, and Ahsay customers
- Technologists and security teams: apply the hotfixes (v10.3.4.45 or v9.15.2.70) and reboot affected servers as Ahsay directed; prioritize checking for the presence of web shells and XMRig miners on systems that were exposed prior to patching, since those payloads were reported by Huntress.
- Federal agencies and regulators: comply with the CISA KEV requirement to patch by October 17, 2026, and ensure inventory and remediation records reflect the updated AhsayCBS hotfix versions.
- Ahsay Backup customers and affected enterprises: confirm that any prior August fixes (9.15.2.59, 10.3.4.0) were replaced with the new hotfix releases (v9.15.2.70 or v10.3.4.45), since the vendor acknowledged the earlier releases did not fully remediate the vulnerabilities.
The record in this episode is clear and immediate: two chained CVEs enabled unauthenticated command execution, threat actors used that capability to install web shells and XMRig miners, initial August fixes were insufficient, and Ahsay has issued corrected hotfixes that Huntress has partially validated. With a CISA-imposed federal deadline of October 17, 2026 and Ahsay's explicit reboot instruction, organizations running AhsayCBS have a short, concrete remediation path — and a narrow window to follow it.
