AhsayCBS releases hotfixes for actively exploited authentication bypass flaws

Singapore-based Ahsay Backup has released emergency security updates for its AhsayCBS backup software following the discovery that previous patches did not fully resolve two critical vulnerabilities. The flaws, identified as CVE-2026-105133 and CVE-2026-105134, are being actively exploited by threat actors to gain unauthorized access to systems. This development comes after initial fixes released in August 2026 were found to be incomplete, leaving many self-hosted environments exposed to remote code execution attacks.

What happened

The security issues involve a chain of two vulnerabilities that allow attackers to bypass authentication mechanisms entirely. When combined, these flaws enable unauthenticated remote code execution, giving adversaries full control over the affected server. Security firm Huntress reported earlier this month that it observed malicious actors leveraging this specific attack chain to deploy web shells and XMRig cryptocurrency miners on compromised systems. Web shells provide persistent backdoor access, while cryptojacking malware hijacks server resources to mine digital currency, often leading to performance degradation and increased operational costs.

Although Ahsay had previously released versions 9.15.2.59 and 10.3.4.0 in August 2026 with the intention of fixing these issues, the company has now confirmed that those updates did not completely plug the security holes. Consequently, new hotfixes have been issued: AhsayCBS v10.3.4.45 and AhsayCBS v9.15.2.70. Huntress independently verified that the new v10.3.4.45 hotfix successfully mitigates the initial entry point of the attack chain, which remained vulnerable in earlier patched versions. Ahsay strongly urges users to apply these hotfixes immediately and reboot their servers to ensure the changes take effect.

Key details

• Vulnerabilities: CVE-2026-105133 and CVE-2026-105134 allow authentication bypass and arbitrary command execution.
• Active exploitation: Threat actors are using the flaws to deploy web shells and XMRig cryptocurrency miners.
• Incomplete prior fixes: Patches released in August 2026 (versions 9.15.2.59 and 10.3.4.0) did not fully resolve the issues.
• New hotfixes: Users must upgrade to AhsayCBS v10.3.4.45 or v9.15.2.70 to address the vulnerabilities.
• Mandatory reboot: Ahsay states that servers must be rebooted after applying the hotfix for security measures to activate.
• Regulatory action: CISA added these flaws to its Known Exploited Vulnerabilities catalog, setting an October 17, 2026 deadline for federal agencies.

Background

Remote code execution (RCE) is one of the most severe types of security vulnerabilities because it allows an attacker to run any command on a target system without needing valid credentials. In this case, the attackers chain two separate flaws to sidestep the normal login process. Once inside, they install web shells, which are malicious scripts that provide a persistent interface for controlling the server remotely. This persistence allows them to return later even if the initial vulnerability is patched, unless the web shell itself is discovered and removed.

Cryptocurrency mining malware, such as XMRig, is a common payload in these types of attacks because it monetizes the compromise immediately by using the victim's computing power. For IT teams managing self-hosted infrastructure, this results in unexpected spikes in CPU usage and electricity costs. The involvement of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) highlights the severity of the threat, as inclusion in the Known Exploited Vulnerabilities (KEV) catalog signals that active exploitation is widespread and dangerous.

Why it matters

For teams running their own backup infrastructure, this incident underscores the risk of relying on single-vendor solutions without rigorous independent verification of security patches. The fact that the August updates were deemed sufficient by many users, only to be revealed as incomplete weeks later, creates a false sense of security. Self-hosting requires a high degree of vigilance because you are responsible for the entire stack, including timely patching and verifying that updates actually resolve the reported issues. Delaying action based on the assumption that a previous patch worked could leave your data exposed to exfiltration or encryption by ransomware operators who often use similar initial access methods.

Furthermore, the requirement to reboot servers after applying the hotfix introduces operational complexity. In many production environments, scheduling downtime for reboots requires careful planning to avoid service disruption. However, given that CISA has set a hard deadline for federal agencies and active exploitation is ongoing, the risk of delaying the reboot outweighs the inconvenience. Teams must balance availability with security, recognizing that an unpatched or improperly patched backup server is a critical liability.

What you can do

• Check your version: Immediately identify if your environment is running AhsayCBS versions prior to 9.15.2.70 or 10.3.4.45.
• Apply the hotfix: Download and install the specific hotfix versions (v9.15.2.70 or v10.3.4.45) from the official Ahsay portal.
• Reboot servers: Schedule and execute a server reboot immediately after patching to ensure the mitigation is active.
• Scan for indicators: Use endpoint detection tools to search for signs of web shells or XMRig processes, such as unusual CPU spikes or unknown scripts in web directories.
• Review access logs: Examine authentication and access logs for suspicious activity dating back to August 2026, when the initial incomplete patches were released.
• Monitor CISA KEV: Keep track of the Known Exploited Vulnerabilities catalog for future mandatory patching deadlines and active threats.