Exploited AhsayCBS flaws get fixes after incomplete patches

Attackers chained two AhsayCBS flaws for SYSTEM access and XMRig; corrected hotfixes and a 17 October CISA deadline followed incomplete patches.

Attackers are exploiting two Ahsay Cloud Backup Server flaws, CVE-2026-105133 and CVE-2026-105134, on exposed on-premises backup servers. Sources disagree on scoring and bug class: the first is an authentication or API bypass scored CVSS 5.5 or 7.3, and the second is described as Replication Receiver command injection, a path-traversal file write, or remote code execution scored CVSS 9.3 or 10.0. Chained, they allow unauthenticated execution as SYSTEM; Horizon3 also says the file write can run a webshell as root on Linux. GBHackers, citing Field Effect, and later reports citing Huntress say exploitation began on 7 October 2026 and hit five or at least five organizations, with JSP webshells and XMRig miners disguised as Microsoft Edge; one Horizon3 point instead places in-the-wild exploitation in August 2026, while The Hacker News says August patches were incomplete. Builds through 10.3.4, including v9.15.2.59 and v10.3.4.0, remained vulnerable. Ahsay’s 12 October 2026 hotfixes, v10.3.4.45 and v9.15.2.70, are the corrected releases, and CISA set a federal KEV deadline of 17 October 2026.

• CVE-2026-105133 (authentication bypass; CVSS 5.5 per GBHackers, CVSS 7.3 per Horizon3) chains with CVE-2026-105134 (command injection, path-traversal file write, or RCE; CVSS 9.3 or 10.0) for unauthenticated code execution as NT…
• Field Effect and Huntress-cited reports date active exploitation from 7 October 2026, affecting five or at least five organizations; one Horizon3 bullet instead says August 2026, while other sources tie August to incomplete patches.
• Observed activity included JSP webshells, XMRig miners disguised as Microsoft Edge, a fake Edge update service, PowerShell scripts, and NSSM service persistence; one report said payloads were hosted on Alibaba Cloud object storage.
• Versions through 10.3.4 were vulnerable, and earlier builds v9.15.2.59 and v10.3.4.0 did not fully fix the flaws even where 10.3.4 had been described as fixed.
• Ahsay issued hotfixes on 12 October 2026; corrected releases are v10.3.4.45 and v9.15.2.70, and Huntress verified that 10.3.4.45 blocks the initial entry point.
• Ahsay directs v7 and v8 users to upgrade to v9.15.0.0 first, then apply the v9 hotfix and reboot.
• CISA added both CVEs to the KEV catalog, with a U.S. federal patch deadline of 17 October 2026.