Singapore-based backup software vendor Ahsay has patched critical vulnerabilities in its AhsayCBS platform—flaws that attackers were already using to deploy web shells and cryptominer malware. Two issues, known as CVE-2026-105133 and CVE-2026-105134, could be chained to bypass authentication and run arbitrary commands on vulnerable servers, making them especially dangerous. According to security specialists, adversaries were combining both flaws to gain remote code execution and implant malware, including XMRig miners.
Initial Patches Fall Short
Ahsay initially released updates in August 2026—versions 9.15.2.59 and 10.3.4.0—that were supposed to fix these weaknesses. However, the fixes proved incomplete. Attackers continued exploiting exposed systems due to lingering vulnerabilities.
Hotfixes Now Available; Urgent Action Needed
New hotfixes—AhsayCBS v10.3.4.45 and v9.15.2.70—have now been released to fully address the two vulnerabilities. Users are strongly urged to apply these updates immediately and reboot their servers afterward to escape active attack paths. Independent verification confirmed that version 10.3.4.45 removes the initial attack vector that earlier patch versions failed to eliminate.
Regulatory pressure is mounting. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added both CVE-2026-105133 and CVE-2026-105134 to its Known Exploited Vulnerabilities catalog. Federal agencies are required to install the hotfixes by October 17, 2026.
These vulnerabilities were already being used in live attacks to deliver web shells—remote access implants that give adversaries control—and deploy cryptocurrency miners aimed at taxing system resources and stealing cloud compute or server capacity. Having a remote code execution vector with no authentication makes systems particularly exposed.
Administrators managing AhsayCBS installations should check their version builds, apply the hotfixes if needed, and reboot their servers to ensure mitigation. Monitoring logs for unexplained directory writes, suspicious command execution, and RPC or API access patterns is also advised.
While vendor updates are essential, this case reinforces broader lessons: patch issuance doesn’t guarantee complete protection until it’s verified; zero-trust should be assumed until you’re certain; and being part of government compliance regimes—like those enforced by CISA—can force faster, more accountable response timelines. Given the high risk, organisations running AhsayCBS should treat this as a top priority update activity.
