# AhsayCBS Backup Flaws Exploited: First Patch Failed, Use 10.3.4.45

Page: https://hirantha.me/blog/ahsaycbs-backup-flaws-exploited-first-patch-failed-use-103445
Published: 2026-10-19
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: ahsaycbs, backup security, cve-2026-105134, cisa kev, msp security

> Two exploited AhsayCBS flaws (CVE-2026-105133, CVE-2026-105134) survive builds 10.3.4.0 and 9.15.2.59; fixed in 10.3.4.45 and 9.15.2.70.

If you run AhsayCBS, the backup server software many managed service providers (MSPs) use to host client backups, check your build number today. Two flaws in its management web service are being chained to take over servers, and the first fix Ahsay shipped did not close them.

## The short version

The two bugs together give an unauthenticated attacker remote command execution on the backup server. Attackers have used that to drop web shells, install cryptocurrency miners and, in at least one case, set up OpenSSH for persistent access. Exploitation was seen from 7 October 2026, and CISA (the US Cybersecurity and Infrastructure Security Agency) listed both flaws as exploited on 14 October.

## Versions: which build is actually safe

The trap here is that a version you may think is patched is not. Using Bitdefender's advisory of 15 October, which follows Ahsay's later guidance:

| Branch | Status | Build |
|---|---|---|
| v10 | Incompletely fixed, still vulnerable | 10.3.4.0 |
| v7, v8, v9 | Incompletely fixed, still vulnerable | 9.15.2.59 |
| v10 | Fixed | 10.3.4.45 |
| v7, v8, v9 | Fixed | 9.15.2.70 |

The National Vulnerability Database (NVD) entries still list 10.3.4 as unaffected, and The Hacker News repeated that the flaws were fixed in 10.3.4. Ahsay's later statement, relayed by Bitdefender, supersedes that. If your asset inventory says "patched in 10.3.4", it is wrong for this issue. As of 19 October 2026, Bitdefender reports no vendor workaround.

## The two CVEs

| CVE | Flaw | CVSS v4 | CVSS v3.1 |
|---|---|---|---|
| CVE-2026-105133 | Improper authentication in `checkSysPwd` | 5.5 | 7.3 |
| CVE-2026-105134 | OS command injection in the Replication Receiver (`/rps/api/json/UpdateReceivers.do`) | 9.3 | 10.0 |

The scores come from VulDB, which acted as the CNA (the body that assigned the CVEs); NVD had not published its own. Note how the authentication bug scores only "medium" on the newer scale: on its own it looks minor, but it is what lets the command injection be reached without credentials. Do not triage by the lower number.

## KEV status

I checked CISA's Known Exploited Vulnerabilities (KEV) catalog data on 19 October 2026. Both CVE-2026-105133 and CVE-2026-105134 are listed with date added 2026-10-14 and a federal due date of 2026-10-17. Some early coverage said otherwise, because it was written before the listing.

## What attackers did

Huntress reported the first exploitation on 7 October at about 23:20 UTC, with at least five organisations affected by 8 October. Bitdefender's managed detection team handled three incidents with the same chain but different tooling, and assesses that several actors may be using it. Observed behaviour included:

- Java Server Page (JSP) web shells to test access.
- An XMRig miner disguised as `edge.exe`, and a PowerShell script that stops mining when Task Manager is opened (Huntress).
- Script and `.cmd` files in `C:\Users\Public`, plus privilege elevation to SYSTEM and OpenSSH installed via obfuscated PowerShell (Bitdefender).
- Staging from `captcha-eyw[.]pages[.]dev` and callbacks to several IP addresses, listed in Bitdefender's advisory.

Bitdefender saw no encryption or data theft in its three cases. A backup server is still a high-value target: it holds credentials for everything it protects.

## What to do in the next 24 hours

1. **Read the build.** In the web console go to System Settings > License > Update License and read the full four-part Product Version.
2. **Patch.** Move to 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9) using Ahsay's hotfix announcement; a vendor support account may be needed. Reboot as instructed.
3. **Close exposure.** Bitdefender recommends limiting the management web service to known administrative networks or a VPN. That is its own recommendation, not vendor guidance, and it reduces exposure without removing the flaw.
4. **Hunt back to 4 October,** the date the CVEs were published. Look for JSP or script files you did not deploy in the AhsayCBS web directories, shells or PowerShell spawned by the AhsayCBS service, unexpected `.cmd` files in `C:\Users\Public`, OpenSSH on a server that never ran it, and new services or scheduled tasks.
5. **If anything turns up,** treat the server as untrusted and rotate AhsayCBS admin accounts, backup storage credentials, service accounts and cached domain credentials.

Patching does not remove a web shell that is already there, so step 4 applies even to servers you update immediately.

## If a provider runs it for you

Many small firms never see this console because their IT provider hosts it. Ask the provider in writing which build they run, whether the management interface is reachable from the internet, and whether they have hunted back to 4 October. Bitdefender specifically advises including provider-operated servers in the exposure check.

## Your deadline

Treat today as the cut-off for confirming the build number and restricting the console, and finish the compromise hunt within the week. Anyone who patched to 10.3.4.0 or 9.15.2.59 in the first days of October should patch again now.

## Questions

**Is AhsayCBS 10.3.4 safe from CVE-2026-105134?**
No. Per Bitdefender, citing Ahsay, v10.3.4.0 did not fully fix the flaws. The fixed build is 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9).

**Does patching AhsayCBS remove an existing compromise?**
No. Bitdefender notes patching does not remove web shells, staged scripts or persistence, so hunt for compromise back to 4 October 2026.

## Sources

- [Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)](https://www.bitdefender.com/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134), bitdefender.com
- [Attackers exploit AhsayCBS flaws](https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html), thehackernews.com
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), cisa.gov