Attackers are exploiting two vulnerabilities in AhsayCBS together. AhsayCBS is a backup management platform typically used by managed service providers and system integrators. Huntress, which found the activity, says the chained flaws let an unauthenticated attacker run commands on the server as NT AUTHORITY\SYSTEM. Its researchers first saw exploitation on October 7, 2026, at 23:20 UTC, and by October 8 had seen attacks against five organizations. eSecurity Planet notes that this figure counts targeted organizations, not necessarily five confirmed breaches. The vendor's first fix did not fully close either hole, and the federal remediation deadline CISA set for both flaws, October 17, has passed.

The two flaws

The first bug, CVE-2026-105133, is an improper-authentication flaw in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java, in the product's API component. NVD carries VulDB's scores for it: 5.5 (Medium) under CVSS 4.0 and 7.3 (High) under CVSS 3.1.

The second, CVE-2026-105134, is an OS command injection in the Replication Receiver component, at the /rps/api/json/UpdateReceivers.do endpoint. VulDB scores it 9.3 (Critical) under CVSS 4.0 and 10.0 (Critical) under CVSS 3.1. NVD published both records on October 4. Each says the attack can be launched remotely and that an exploit has been made public.

According to BleepingComputer's account of Huntress's findings, the attackers used CVE-2026-105133 to get past authentication and CVE-2026-105134 to execute code. Both NVD records describe AhsayCBS versions up to 10.3.2 as affected and say upgrading to 10.3.4 mitigates the issue. Huntress and Ahsay have since contradicted that.

A patch that wasn't

BleepingComputer's October 9 report quotes a Huntress update: "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities." On October 10, according to eSecurity Planet, Ahsay confirmed that version 10.3.4.0 "had not adequately addressed CVE-2026-105133 and CVE-2026-105134." The vendor told affected version 10 partners to install hotfix 10.3.4.45 through its authenticated partner portal and then reboot their servers.

eSecurity Planet adds a caveat: in the sources it reviewed, no independent testing had yet confirmed that the hotfix fully resolves both vulnerabilities.

NVD's remediation text, which still names 10.3.4, therefore points administrators to a build the vendor says is not fully fixed. A server that was upgraded to 10.3.4.0 after the disclosure and left there remains exposed.

What the attackers did

BleepingComputer describes the sequence Huntress observed. After gaining access, the attackers performed reconnaissance on the host and installed Java Server Pages (JSP) webshells. They then downloaded the XMRig cryptocurrency miner, disguised as edge.exe. For persistence they created a service named MicrosoftEdgeUpdateSvc, which mimics Microsoft's legitimate updater. Huntress identified the service binary as a modified copy of the Non-Sucking Service Manager (NSSM) utility.

Huntress believes a PowerShell script used in the intrusions, Taskgmr.ps1, was written with AI assistance. Its purpose was concealment: it stopped the mining service whenever Task Manager was opened and restarted it afterward. In one case the attackers also installed WinRing0x64.sys, a known-vulnerable driver. BleepingComputer reports this was likely done to unlock more hardware resources for the miner.

According to eSecurity Planet, Huntress did not report ransomware deployment or confirmed theft of backup data in the incidents it investigated.

Why the KEV listing matters here

CISA added both AhsayCBS CVEs to its Known Exploited Vulnerabilities (KEV) catalog on October 14, in a batch of four. The other two were CVE-2026-0322, a code injection flaw in Palo Alto Networks PAN-OS, and CVE-2026-76519, a path traversal flaw in Cisco Secure Email Gateway. NVD records an action-due date of October 17 for both Ahsay entries, three days after they were added.

The deadline applies under Binding Operational Directive 26-04, which covers Federal Civilian Executive Branch agencies. CISA's required action also points agencies to its forensics triage requirements and tells them to discontinue use of the product if mitigations are unavailable. For private operators, the listing is not a compliance date. It is CISA's confirmation that the flaws are being exploited.

What It Means for Defenders

  • Apply hotfix 10.3.4.45, reboot, and verify the running build. eSecurity Planet recommends confirming the build after the reboot rather than assuming the hotfix took.
  • Limit the management interface to trusted IP addresses or a VPN. Huntress advised this restriction while no working patch existed. eSecurity Planet also recommends isolating backup infrastructure from the wider network.
  • Hunt for compromise that predates the hotfix. "Patching cannot remove malicious persistence from systems already compromised," eSecurity Planet notes. Look for unusual processes spawned by cbssvcX64.exe, unfamiliar services, JSP files you did not deploy, unauthorized replication receivers, and unexpected configuration changes. Run Huntress's four published Sigma rules and its IoC list against your telemetry. Preserve forensic evidence before you remediate.
  • Rebuild confirmed compromised hosts from a known-safe backup. Huntress recommends a full host restore because other backdoors may be present. Rotate credentials that may have been exposed, and check the integrity of the backups the server holds.

Sources