AhsayCBS hotfixes address flaws used for web shells and miners
Ahsay Backup has issued new security hotfixes for two AhsayCBS vulnerabilities that attackers have actively exploited to deploy web shells and XMRig cryptocurrency miners. The flaws, tracked as CVE-2026-105133 and CVE-2026-105134, can be chained to bypass authentication and execute arbitrary commands on affected systems.
The company released the corrected fixes as AhsayCBS v10.3.4.45 hotfix and AhsayCBS v9.15.2.70 hotfix. They supersede the earlier expectation that versions 9.15.2.59 and 10.3.4.0, released in August 2026, had fully addressed the vulnerabilities.
Earlier patches did not fully close the attack path
Huntress reported earlier in October that threat actors were combining the two vulnerabilities to gain unauthenticated remote code execution on exposed AhsayCBS installations. After obtaining access, the actors deployed web shells, which can provide persistent remote control, and XMRig miners.
Ahsay has now confirmed that the earlier patches did not completely eliminate the flaws. The distinction matters for organisations that treated an August upgrade as final remediation: systems may still have remained exposed to the initial access route described by Huntress.
In an update, Huntress said it independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point in the attack chain. The security firm said that entry point had remained susceptible in previous version 10 releases.
CISA lists both issues as known exploited vulnerabilities
Active exploitation has also led the U.S. Cybersecurity and Infrastructure Security Agency to add CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities catalog. Federal agencies are required to apply the patches by October 17, 2026.
The KEV listing reflects observed exploitation rather than a theoretical risk. For administrators, the relevant exposure is not limited to either flaw in isolation: the reported attack technique relies on chaining them to evade authentication before running commands on the backup environment.
Apply the hotfix and validate exposed systems
Ahsay urged customers to take immediate action to secure their environments and protect customer data. The company also instructs administrators to reboot the server after applying the hotfix.
Businesses running AhsayCBS should identify the deployed version, install the applicable 10.3.4.45 or 9.15.2.70 hotfix, restart the server, and examine internet-exposed systems for web shells or XMRig activity. Because the initial fixes were incomplete and exploitation has been observed, completing the updated remediation is the practical priority.