Ahsay ships second hotfix round for actively exploited AhsayCBS backup console flaws

Ahsay has shipped a second round of hotfixes for its AhsayCBS backup management console after admitting that the first round of patches did not fully resolve two vulnerabilities that attackers are already chaining against internet-exposed servers. In a vendor announcement dated 12 October 2026, customers on version 10 are directed to hotfix 10.3.4.45 and those running versions 7 through 9 to 9.15.2.70, with a server reboot required after applying either.

AhsayCBS is the web console that service providers run to store and administer backup data for their customers. According to BleepingComputer's coverage of the campaign, the platform is typically operated by managed service providers and system integrators, which means a single compromised appliance can expose the recovery copies of multiple companies.

Two flaws that work as a pair

NVD published the two records on 4 October 2026. CVE-2026-105133 is an improper authentication weakness in the checkSysPwd function, rated medium. CVE-2026-105134 is a command injection flaw in the UpdateReceivers.do endpoint of the Replication Receiver component, rated critical, permitting unauthenticated code execution as NT AUTHORITY/SYSTEM. The severity ratings and technical detail come from Huntress research published on 8 October 2026.

The bypass is what makes the injection reachable. The authentication check accepts a random token in place of real credentials, so an attacker's request arrives at the Replication Receiver API as an authenticated caller, and the injected command runs with the service's privileges. The records map to CWE-287 for the bypass and CWE-77 and CWE-78 for the injection, which matters for anyone writing detections: filtering on the critical identifier alone misses the medium-severity flaw that opens the chain.

Active exploitation and post-compromise behaviour

Huntress first saw attacks at 23:20 UTC on 7 October 2026, and by the next day five organisations in its own customer base had been targeted. In the observed intrusions, attackers configured a malicious replication receiver and wrote a JSP webshell into the directory the application serves. Payloads named Taskgmr.ps1, msedge.exe, edge.exe and config.json were pulled from an Alibaba Cloud object storage host. An XMRig cryptocurrency miner was renamed to resemble a Microsoft Edge process and kept running through a service named MicrosoftEdgeUpdateSvc, built on a modified copy of the Non-Sucking Service Manager binary executing from a Temp folder with SYSTEM privileges. The attackers also retrieved WinRing0x64.sys, a legitimate but vulnerable kernel driver, so the miner could reach the hardware directly.

One script exists mainly to conceal the mining: it suspends the service while Task Manager is open, restarts it when the window closes, and terminates Task Manager at 18:00 local time or after it has stayed open for an hour overnight. Huntress has published indicators of compromise and four Sigma rules.

Why a second round of patches

BleepingComputer and SecurityWeek reported that NVD's records named version 10.3.2 as the fixed release, while Huntress found every version through 10.3.4 still affected. Ahsay's 12 October statement goes further, saying plainly that the earlier patches v9.15.2.59 and v10.3.4.0 did not fully address the vulnerabilities. Huntress has since verified independently that the 10.3.4.45 hotfix closes the initial entry point of the chain, a gap that remained in previous version 10 builds. Both hotfixes sit behind the vendor's partner portal login.

CISA adds both flaws to its exploited list

On 14 October 2026 CISA placed both records in its Known Exploited Vulnerabilities catalogue with a remediation deadline of 17 October, a three-day clock for US federal agencies and a priority signal for everyone else. The command injection entry requires forensic triage, and ransomware use is recorded as unknown. The catalogue's stated remediation is to apply vendor mitigations, assess each asset's internet exposure, and stop using the product where mitigations are unavailable. For a backup server, that fallback amounts to taking the appliance out of service.

Why it matters

An incomplete patch for an actively exploited chain can be worse than a slow one, because operators who applied the first round in good faith may believe they are protected while the entry point is still open. The target amplifies the stakes: the console holds the recovery copies for other companies' systems, so compromising it removes the ability to restore at the moment restoration is needed most. The episode is also a lesson in verification. The fixed version listed in a disclosure record is not itself proof that remediation works, and here the confirmation came from a third party with telemetry on live attacks.

What operators should do now

The sources point to three steps. Move the management interface off the public internet and restrict it to trusted addresses or a private network path. Apply the hotfix matching the installed version and reboot, as the vendor instructs. Where any published indicator is present, rebuild the host from a trusted backup, since Huntress warns that secondary backdoors can remain in place for extended persistence.