Ahsay Ships AhsayCBS Hotfixes as Huntress Reports Attacks on CVE-2026-105134

Ahsay has released hotfixes for AhsayCBS after saying its earlier patches did not fully address CVE-2026-105133 and CVE-2026-105134, two flaws that Huntress reports are being chained in attacks on the backup server’s management console.

In an announcement dated October 12, 2026, Ahsay says its previous patches, v9.15.2.59 and v10.3.4.0, did not fully address the two vulnerabilities. Partners running affected v10 versions should apply the AhsayCBS v10.3.4.45 hotfix. Partners on v7, v8 and v9 should apply v9.15.2.70. Both hotfixes sit behind the partner portal, which requires a login, and Ahsay says to reboot the server afterward.

Huntress described the attacks in a research post published October 8 and updated October 12. It says the two CVEs were disclosed on October 4 and that it began seeing exploitation on October 7 at 23:20:15 UTC. As of October 8, Huntress had seen five organizations targeted. CVE-2026-105133 is a medium-severity authentication flaw and CVE-2026-105134 is a critical flaw in the Replication Receiver component that can lead to unauthenticated code execution as the SYSTEM account. Huntress says attackers chain the two, then run reconnaissance, drop webshells and plant XMRig cryptominers disguised as Microsoft Edge.

Huntress also corrected an earlier statement: after investigating, it found that AhsayCBS 10.3.4 is affected too. It says it independently verified that the 10.3.4.45 hotfix mitigates the initial entry point of the chain.

AhsayCBS is the management console for Ahsay’s backup software, and Huntress says managed service providers and system integrators are its main users. In our reading, that makes a compromised console a way into the backup data and the client environments behind it, so the response covers more than the hotfix. Apply it, restrict who can reach the management interface, and hunt for webshells and unexpected child processes of the AhsayCBS service. Our opinion piece on keeping a self-hosted CI server off the public Internet makes the same argument about a different admin console, and the case for rebuilding an exploited device applies to a server that ran a webshell.

Source: Ahsay, Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134