Backup Software Flaws Still Exploited After Incomplete Patches: AhsayCBS Users Told to Update Again

Singapore-based Ahsay Backup has released further security updates for two vulnerabilities in its AhsayCBS backup software, tracked as CVE-2026-105133 and CVE-2026-105134. Attackers have been exploiting the flaws to install web shells (hidden tools that give remote control of a server) and XMRig cryptocurrency miners. Chained together, the two flaws can bypass authentication and run arbitrary commands on affected systems.

Security firm Huntress reported earlier this month that it had seen attackers combine the flaws to achieve unauthenticated remote code execution on exposed systems. The vulnerabilities were first thought to be fixed in AhsayCBS versions 9.15.2.59 and 10.3.4.0, released in August 2026. Ahsay has now confirmed those patches did not fully close the problem. Huntress says it independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point of the attack chain, which was still open on earlier v10 versions.

Ahsay has urged customers to act immediately to protect their environment and their customers' data, and to reboot the server after applying the hotfix. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by October 17, 2026. This article covers only the opening of the original report.