AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ahsay re-patched exploited AhsayCBS flaws after incomplete fixes still allowed web shells and XMRig miners.
Ahsay released new AhsayCBS hotfixes after confirming that August patches did not fully close CVE-2026-105133 and CVE-2026-105134, which can be chained to bypass authentication and execute commands. Huntress observed attackers using the pair for unauthenticated remote code execution and deploying web shells and XMRig miners. Corrected builds are 10.3.4.45 and 9.15.2.70; Huntress verified that 10.3.4.45 blocks the initial entry point. CISA added both flaws to the KEV catalog, with a federal patch deadline of October 17, 2026.
- CVE-2026-105133 and CVE-2026-105134 chain into unauthenticated remote code execution.
- Huntress observed web shells and XMRig cryptocurrency miners on exposed systems.
- August builds 9.15.2.59 and 10.3.4.0 did not fully fix the flaws.
- Hotfixes 10.3.4.45 and 9.15.2.70 are the corrected releases.
- CISA KEV requires federal agencies to patch by October 17, 2026.
Vulnerabilities mentionedAll →
- CVE-2026-1051349.33%Unauthenticated OS Command Injection in AhsayCBSpublished · AhsayCBS KEV PoC +1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 9.15.2.59 | were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company |
Full article266 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 15, 2026Vulnerability / Cryptojacking
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.
In a report published earlier this month, Huntress said it observed threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on exposed systems.
Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them.
The fixes are available in the following versions -
- AhsayCBS v10.3.4.45 hotfix
- AhsayCBS v9.15.2.70 hotfix
"Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customer's data," Ahsay said. "After applying the hotfix, please reboot your server."
In an update, Huntress said it has "independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point of this attack chain, which was still susceptible on previous v10 versions."
The active exploitation of the flaws has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add them to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the patches by October 17, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html