Ahsay's August patch left the RCE flaws exploitable

AhsayCBS versions 9.15.2.59 and 10.3.4.0, released in August 2026, were supposed to close two vulnerabilities that attackers were already chaining into unauthenticated remote code execution. They did not. Ahsay Backup has confirmed the August patches left the flaws exploitable and shipped new hotfixes, v10.3.4.45 and v9.15.2.70.

The two bugs are CVE-2026-105133 and CVE-2026-105134: an authentication bypass and a command-execution flaw. Chained, they let an unauthenticated attacker run arbitrary commands on the server. Huntress reported earlier this month that it had seen threat actors combine them in the wild to drop web shells and XMRig cryptocurrency miners on exposed AhsayCBS systems.

AhsayCBS is backup-management software, which makes the host a useful thing to own. A box running it usually holds credentials or network paths to whatever it backs up, so an attacker who lands a web shell there sits close to a lot of customer data. A crypto-miner is the low-effort way to monetise that access; the same foothold supports anything else.

The failed first patch is the part that should worry anyone who already acted. Applying the August release and closing the ticket leaves a v10 system exposed. Huntress said it “independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point of this attack chain, which was still susceptible on previous v10 versions.” The entry point surviving the first fix is the whole reason for a second round.

CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of October 17, 2026. For federal systems that is binding; for everyone else it confirms exploitation is routine rather than theoretical.

Steps that follow from this:

• Patch to v10.3.4.45 or v9.15.2.70, depending on your branch. Ahsay says to reboot the server after applying the hotfix, so plan the window.
• Treat any AhsayCBS instance that was internet-facing before patching as potentially compromised. Patching does not evict an attacker who is already in. Hunt for unexpected files in web-served directories, unfamiliar scheduled tasks, and miner processes.
• Rotate every credential stored on or reachable from the backup server. If the host was taken, the backup targets are the next hop.