Updated: Ahsay Admits AhsayCBS Vulnerability Fixes Were Incomplete, Releases New Hotfixes
Ahsay said earlier fixes for two actively exploited AhsayCBS vulnerabilities were incomplete. It recommends that administrators deploy the new hotfixes and rebuild servers showing signs of compromise.
AhsayCBS hotfixes for vulnerabilities CVE-2026-105133 and CVE-2026-105134 must be deployed again by administrators, even if they already applied the earlier fixes. On October 12, the vendor confirmed that versions v9.15.2.59 and v10.3.4.0 did not fully address either vulnerability.
The new fixes are intended for AhsayCBS, a product used to manage backups. Ahsay released hotfix v10.3.4.45 for the AhsayCBS v10 branch and hotfix v9.15.2.70 for versions v7, v8, and v9. According to the vendor, both hotfixes fully address CVE-2026-105133 and CVE-2026-105134.
AhsayCBS hotfixes replace earlier incomplete fixes
The announcement changes the guidance for organizations that relied on v10.3.4.0 or v9.15.2.59. These versions can no longer be considered sufficient fixes for the vulnerabilities; organizations should move to newer hotfixes corresponding to their product branch.
The vulnerabilities are not merely a theoretical risk. Security firm Huntress previously confirmed active exploitation of the flaw chain against publicly accessible AhsayCBS servers. In observed cases, attackers deployed JSP webshells and the XMRig cryptocurrency miner.
A webshell can give an attacker remote access to a compromised system even after the initial intrusion. Therefore, updating alone may not resolve an incident that has already occurred.
When a breach is suspected, Ahsay recommends rebuilding the server
For systems showing signs of compromise, Ahsay recommends completely rebuilding the server, applying the appropriate hotfix, and restoring the configuration from a version created before the incident. This procedure is intended to remove possible persistence that an attacker may have left after exploiting the vulnerability.
Publicly accessible AhsayCBS installations are the highest priority, as exploitation against them has been confirmed. Administrators should verify that they are using the correct new hotfix: v10.3.4.45 for AhsayCBS v10, or v9.15.2.70 for branches v7 through v9.
If indicators of compromise appear, deploying the fix alone is not sufficient according to the vendor’s recommendation. In that case, the server should be rebuilt and the configuration restored from a known-clean state.
The effectiveness of the new fixes has not yet been independently verified
Ahsay claims that the new AhsayCBS hotfixes fully address both CVEs, but no independent technical verification that they block all exploitation variants has been publicly found. The total number of compromised organizations, the attackers’ identity, and the campaign’s full scope have also not been publicly confirmed.
Further developments may bring independent testing of the hotfixes, new indicators of compromise, or information about the spread of the observed activity. It should also be monitored whether CVE-2026-105133 and CVE-2026-105134 are added to the CISA Known Exploited Vulnerabilities catalog.
Sources
- Ahsay Backup — AhsayCBS Vulnerability Status Update – Confirms the hotfix dates, their versions, the vendor’s claim that both CVEs were fully addressed, and the recommended recovery procedure after compromise.
- Ahsay Backup — Critical Security Alert update – Confirms that the earlier fixes v9.15.2.59 and v10.3.4.0 were incomplete and that new hotfixes must be deployed.
- Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer – Documents observed active exploitation, vulnerability chaining, JSP webshells, and deployment of XMRig.
Verified and updated: October 15, 2026 15:25
