AhsayCBS Backup Server Flaws Exploited After Patches Fell Short: What IT Teams Should Do Now

This is a briefing for IT and security teams that run Ahsay backup infrastructure or buy backup services built on it. It draws on the two sources listed at the end, which agree on the core technical details.

What Happened

Security firm Huntress observed attackers exploiting AhsayCBS, the management console of Ahsay backup software, beginning on October 7, 2026. The attacks chain an authentication flaw with a command injection bug to execute code on the server, and CISA has since listed both flaws as exploited.

According to The Hacker News, which reported Huntress research on October 9, CVE-2026-105133 is an improper authentication issue rated 5.5 on CVSS v4, and CVE-2026-105134 is an OS command injection in the Replication Receiver component rated 9.3. The CVE identifiers were published on October 4, 2026, and Huntress estimated about five organizations were affected as of October 8.

Help Net Security reported on October 15 that CISA added both flaws to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until October 17 to address them. Outlets differ by a day on the listing date, between October 14 and 15, so check the catalog entry for the exact date.

Why Earlier Patches Did Not Hold

The notable twist is that vendor fixes were incomplete. Huntress found that version 10.3.4, which advisories described as fixed, remained affected, so the flaws were treated as zero-days. Help Net Security reports that Ahsay later said its earlier patches did not fully fix either CVE.

The fixed release for the v10 line, per Help Net Security, is 10.3.4.45. The same report mentions a separate fixed build for older v7 to v9 branches, so customers on those lines should read the vendor advisory for their exact version. Reboot as the vendor instructs, and do not assume that a previous patch ticket in your records means you are safe.

How the Attacks Worked

Attackers used the authentication bypass first and then the command injection to gain remote code execution, which Help Net Security notes ran with SYSTEM privileges. After access, Huntress saw reconnaissance, web shells and cryptominer deployment.

• Dropped web shells for persistent access.
• Installed an XMRig cryptominer disguised as a Microsoft Edge executable named edge.exe.
• Ran a PowerShell script reported as likely AI-assisted that stops mining when Task Manager opens.
• In at least one case, used certutil to fetch a legitimate but vulnerable driver, likely to tune mining hardware access.

Cryptomining is the noisy payload. The same access could be used to read, tamper with or delete backups, which is the more serious business risk.

Why It Matters for B2B SaaS Buyers and IT Teams

Backup servers hold copies of your most sensitive data and often have broad credentials to reach it. A compromised backup console can expose data, undermine recovery and let ransomware operators remove your safety net before they attack.

The case also affects service providers. Ahsay software is commonly white-labelled, so a managed service provider customer may be exposed even if its own staff never installed the product. If you buy backup as a service, ask your provider in writing whether it runs AhsayCBS, which version and when it patched.

When comparing options, check patch history, advisory transparency and whether the management interface can be kept off the internet. Our Backup & Recovery Software and SaaS Backup Software categories list alternatives for buyers who want to review the market.

What To Do Now

Find every AhsayCBS instance, patch to the vendor fixed build, cut off public access to the console, then hunt for compromise. Treat any exposed, unpatched server as potentially breached until reviewed, and verify that your backups are intact.

1. Inventory Ahsay servers, including those run by your managed service providers.
2. Apply hotfix 10.3.4.45 on v10 or the vendor build for your line, and reboot as instructed.
3. Restrict console access to trusted IP addresses or a VPN, as Huntress recommends.
4. Hunt for web shells, an edge.exe process outside the real Edge path, unusual PowerShell and certutil downloads, and unexpected high CPU use.
5. Rotate credentials stored on or used by the backup server if you find signs of compromise.
6. Test a restore from an offline or immutable copy to confirm backups were not tampered with.
7. Confirm patch status across the fleet with vulnerability management software.

This is the latest in a run of exploited edge and management products, including the Ivanti Connect Secure zero-day chain and the PAN-OS zero-day. Build a standing routine for CISA catalog additions so these items reach an owner the same day.

Frequently Asked Questions

Do I need to act if I only use a managed backup provider?
Yes. Ask your provider whether it runs AhsayCBS, which version it uses and when it applied the fixed build. Request written confirmation and any indicators of compromise it checked, since you cannot patch the provider infrastructure yourself.

Is version 10.3.4 safe?
No. Huntress found 10.3.4 still affected, and Ahsay said earlier patches did not fully fix the flaws. The fixed v10 build named in reports is 10.3.4.45, so confirm your exact build number in the console.

How do I check if my backup server was compromised?
Look for web shells in the application directories, an unexpected edge.exe process, unusual PowerShell activity and certutil downloads. If you find any, isolate the server, preserve logs, rotate credentials and verify your backups before restoring.