AhsayCBS backup server flaws actively exploited to take over servers without lo…

What happened

AhsayCBS (Ahsay Cloud Backup Server) is the server side of backup software made by the Singapore-based company Ahsay. It is the central console where administrators manage backups, users and backup policies. It is mostly used by managed service providers (MSPs) and system integrators to back up their customers’ data.

Two vulnerabilities were published on October 4, 2026. CVE-2026-105133 lets an attacker bypass the login, and CVE-2026-105134 lets them run operating system commands on the server. Security firm Huntress saw them being exploited from October 7, 2026, and by October 8 had seen five organizations targeted. Attackers chain the two: first they bypass the login, then they run their own code.

Ahsay started receiving reports of unauthorized access from partners on October 9, 2026, and released hotfixes on October 10 and 12. On October 12 it also announced that its earlier patches 9.15.2.59 and 10.3.4.0 had not fully fixed the flaws. According to The Hacker News, the flaws were exploited as zero-days, meaning before any fix existed.

The US agency CISA added both flaws to its catalog of actively exploited vulnerabilities on October 14, 2026. The EU Vulnerability Database (EUVD) lists them as exploited since the same day.

Why it is dangerous

The first flaw (CVE-2026-105133) is an authentication flaw. Picture a security guard who is supposed to check ID badges but, under certain conditions, lets in someone holding a made-up badge. The second flaw (CVE-2026-105134) is command injection: the server takes input from outside and mistakenly lets the operating system run it as a command. Together they give an attacker both a way in and the keys to everything.

The attack goes over the internet against the AhsayCBS web interface, and the attacker needs no login and no user interaction. Huntress observed attackers gaining NT AUTHORITY\SYSTEM privileges on Windows servers, the highest level possible. They deployed webshells (hidden pages for controlling the server), Monero crypto miners disguised as Microsoft Edge, tunneling tools and remote access software.

A backup server is an especially valuable target. It holds customer data and often credentials for hypervisors, storage and domain accounts. In one environment Huntress saw the attacker try to pull stored passwords from a neighboring Veeam server as well. CISA has not stated whether ransomware groups are exploiting these flaws.

The CVSS score (0 to 10) expresses how severe a flaw is. CVE-2026-105134 has the maximum score of 10.0 and CVE-2026-105133 has 7.3. Both scores were assigned by VulDB, the organization that registered the flaws, not by NVD. EPSS estimates the probability of exploitation in the next 30 days: as of November 13, 2026 it is about 82% and 84%, higher than for 99% of all known vulnerabilities.

The CISA KEV catalog lists flaws with confirmed exploitation. US federal agencies had to address these flaws by October 17, 2026, just three days after they were added.

Who is affected

AhsayCBS servers running these versions are affected:

AhsayCBS v7, v8 and v9 up to and including 9.15.2.69
AhsayCBS v10 up to and including 10.3.4.44
servers with the first patches 9.15.2.59 or 10.3.4.0, which did not fully fix the flaws

These are typically backup servers run by IT service providers that receive customer backups over the internet and therefore expose their web interface publicly. According to Ahsay’s instructions, AhsayCBS runs on both Windows and Linux. The attacks described by Huntress involved Windows servers.

If your company only sends backups to a provider that uses Ahsay, it is the provider’s server that is vulnerable. Neither Ahsay nor Huntress says the client backup applications are affected. Still, ask your provider whether they have updated and checked the server, because your data sits on it.

How to check if you are affected

Check the version in the AhsayCBS web admin console and compare it with the list above. On a Windows server you can safely check, read-only in PowerShell, whether and from where the AhsayCBS service runs:

Get-CimInstance Win32_Service | Where-Object { $_.PathName -like "*cbssvc*" } | Select-Object Name, State, PathName

The list of installed programs may also show the version. A hotfix may not be reflected there, though, so the console is what counts:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -like "*Ahsay*" } | Select-Object DisplayName, DisplayVersion

It is just as important to know whether the console is reachable from the internet. Review the firewall and port forwarding (NAT) rules on your edge router. If the AhsayCBS web interface can be reached from outside without VPN, the server is exposed.

How to fix it

Ahsay has released hotfixes: 10.3.4.45 for v10 and 9.15.2.70 for v7, v8 and v9. Only partners with an Ahsay partner portal account can download them. According to The Hacker News, Ahsay later also released version 10.3.6.1 with additional security hardening and urges partners to apply the latest fixes.

Work in this order:

Immediately restrict access to the AhsayCBS web interface to trusted IP addresses or VPN only. Huntress recommends this as a temporary measure. If customers send backups to the server, account for their addresses so backups keep working.
Check the server for signs of compromise (see the next section). If you find any, updating alone is not enough.
Download the hotfix for your major version from the Ahsay partner portal: 10.3.4.45 for v10, 9.15.2.70 for v7, v8 and v9.
Back up the server configuration before installing, then apply the hotfix following the vendor’s instructions.
Reboot the server after installation, as the vendor explicitly requires.
Confirm in the console that the fixed version is running, and consider moving to 10.3.6.1.

If you installed the first patches 9.15.2.59 or 10.3.4.0, the server is not protected. If a supplier manages the server for you, ask them for written confirmation of the version.

What if you may already be compromised

Attacks predate the fixes. If your server faced the internet, check it even after updating. Ahsay and Huntress list these signs:

folders in the drive root such as ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt
random .jsp files (e.g. 75bc584d292933ad.jsp) or folders like xtj7iu, kje74x, 103y9r in %CBS%\webapps (AhsayCBS install folder)
unknown RPS receivers or “Admin” accounts in the console
a MicrosoftEdgeUpdateSvc service, msedge.exe, edge.exe, Taskgmr.ps1, WinRing0x64.sys in Temp, a kvm-agent.exe task, Defender exclusions
child processes of cbssvcX64.exe, unexpected AnyDesk, Atera, Splashtop, GOST or Chisel, connections to imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, creepexplosiondarknight[.]com or port 8029

Get-ChildItem C:\ -Directory | Select-Object Name, CreationTime
Get-Service MicrosoftEdgeUpdateSvc -ErrorAction SilentlyContinue
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess

If you find any sign, don’t clean the server by hand. Ahsay advises reinstalling the OS and the latest AhsayCBS, then restoring the configuration from an Auto Save at least a day older than the first suspicious files. Change passwords stored on the server and call in an incident responder.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

AhsayCBS backup server flaws actively exploited to take over servers without login