AhsayCBS Backup Servers Exploited Through Two Flaws That Ahsay's First Two Patches Did Not Fix
Security / news
AhsayCBS Backup Servers Exploited Through Two Flaws That Ahsay's First Two Patches Did Not Fix
Bitdefender and Huntress both saw attackers chain CVE-2026-105133 and CVE-2026-105134 for SYSTEM-level code execution. Builds 10.3.4.0 and 9.15.2.59 remain vulnerable; the working hotfixes arrived October 12.
Attackers are chaining two flaws in AhsayCBS backup servers, CVE-2026-105133 and CVE-2026-105134, to run commands without logging in. Ahsay's first fixes, builds 10.3.4.0 and 9.15.2.59, did not close them, and the corrective hotfixes (10.3.4.45 and 9.15.2.70) shipped on October 12.
The precondition is that the management web service is reachable by the attacker. Bitdefender published its technical advisory on October 15. CISA had added both CVEs to its catalog on October 14 with an October 17 deadline.
The two flaws and why their scores disagree
CVE-2026-105133 is an improper authentication flaw (CWE-287) in the checkSysPwd function, triggered by manipulating the random argument. CVE-2026-105134 is an OS command injection (CWE-77, CWE-78) in the Replication Receiver component, at /rps/api/json/UpdateReceivers.do, and is also triggered through random. Both need no privileges and no user interaction.
| CVE | Weakness | CVSS 3.1 | CVSS 4.0 |
|---|---|---|---|
| CVE-2026-105133 | Improper authentication | 7.3 | 5.5 |
| CVE-2026-105134 | OS command injection | 10.0 | 9.3 |
The scores come from VulDB, the CVE numbering authority, according to Bitdefender. NVD had not published its own.
The score overstates the first bug and understates the pair. Taken alone, a 5.5 authentication bypass looks routine. Chained ahead of a 9.3 command injection, it is the unauthenticated front door. Huntress, as quoted by BleepingComputer, reports that the chain runs code as NT AUTHORITY\SYSTEM.
Why the patch history matters more than the CVSS
The sources disagree about which builds are safe, and that disagreement is the story for anyone running a backup server. Bitdefender's advisory says Ahsay's v10.3.4.0 and v9.15.2.59 did not fully fix the flaws. NVD still lists 10.3.4 as unaffected, which Bitdefender says the later vendor advisory supersedes. BleepingComputer's earlier report described the bugs as fixed in 10.3.2, and said Huntress found that 10.3.4 is affected too.
The fixed builds are v10.3.4.45 for version 10 and v9.15.2.70 for versions 7, 8 and 9, according to Bitdefender. The hotfixes are distributed through Ahsay's authenticated partner portal, so a vendor support account may be needed to download them.
Timeline: October 4 to October 17
- October 4, 07:16 UTC: both CVEs appear in NVD, with entries stating a public exploit exists.
- October 7, 23:20 UTC: Huntress sees the first chained attack, per BleepingComputer. At least five organisations were targeted by October 8.
- October 12: Ahsay releases hotfixes and states the earlier patches were incomplete.
- October 14: CISA adds both CVEs. Bitdefender's managed detection team identifies a third incident.
- October 17: the federal remediation deadline.
A public exploit existed three days before the first attack was observed.
What the attackers did after getting in
All three of Bitdefender's incidents began with both CVEs. In two, the attackers planted JSP web shells, staged .cmd files in C:\Users\Public, ran PowerShell, and in one escalated to SYSTEM and installed OpenSSH. The scripts were staged on a subdomain of a public static-site hosting service. Bitdefender did not observe encryption, data theft or ransomware.
Huntress, which saw a different set of victims, reported XMRig cryptominers disguised as edge.exe and a service named MicrosoftEdgeUpdateSvc for persistence. Bitdefender does not attribute the activity to a named actor and assesses that several actors may be using the same chain.
Backup servers hold storage-destination credentials and cached domain credentials, which is why Bitdefender tells compromised users to rotate those, not only the admin password.
What to do
Check the build under System Settings, then License, then Update License, and compare the full four-part version with the fixed ones. Patch, reboot, and restrict the management web service to known administrative networks. Search from October 4 onward for unexpected JSP files, shells spawned from the AhsayCBS service, and unknown services. Bitdefender published five command-and-control IP addresses and no file hashes. The same advice on checking before trusting a patch applies to the Cisco Secure Email Gateway bug, also added to the catalog on October 14, and to the PAN-OS flaw listed the same day.
Until the 10.3.4.45 or 9.15.2.70 hotfix is installed, treat any AhsayCBS server reachable from an untrusted network as exposed.
Sources
More in Security
- 01PAN-OS CVE-2026-0322 Gives Root on the Firewall, but Only to Someone Already Holding an Admin LoginPalo Alto Networks confirms limited attacks on the management interface, and CISA gave federal agencies until Oct. 17 to patch.
- 02AdFection: Citizen Lab Says Ad Auctions Delivered Candiru Spyware to 45 Al Jazeera DevicesReport 195 names Israeli ad firm Discover-Tech as the bridge between mercenary spyware and programmatic advertising. The numbers show how few of the ads were weaponised, and why that makes them harder to catch.
- 03PyPI Wheels Carry Binaries Nobody Can Tie to Their SourcePython developer Artem Golubin argues that clean source can ship beside a malicious wheel, and the May 2026 TanStack incident shows a valid signature does not settle it.
- 04Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedThe Oct. 13 release is a record by BleepingComputer’s count, but three trackers report three different totals and the exploited bug needs a user to open a file.