Small Town Sysadmin
Free CJIS checklist

Useful tools

Security alert

Patch AhsayCBS backup servers again: two chained flaws are being exploited, and the first patches weren't enough

CISA added two AhsayCBS flaws to its exploited list on October 14. Ahsay says earlier patches did not fully fix them. Here is which hotfix to apply, who can get it, and what to check.

If you run an AhsayCBS server, or your backup provider does, check its version today. AhsayCBS is the central server for Ahsay’s backup products, and many small MSPs and backup resellers host it for their customers. Two flaws, CVE-2026-105133 and CVE-2026-105134, can be chained: the first bypasses the login, and the second lets a remote attacker run operating system commands. CISA added both to the Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026.

The part that catches people: Ahsay’s own advisory, updated October 12, says the earlier patches (v9.15.2.59 and v10.3.4.0) did not fully fix these flaws. If you patched earlier this month and stopped there, you may still be exposed.

A backup server holds copies of everything, usually with stored credentials and often with broad access to the machines it protects. A takeover here is worse than most.

The details

  • CVEs: CVE-2026-105133 (improper authentication) and CVE-2026-105134 (OS command injection). CISA says they can be chained.
  • Severity: NVD lists a CVSS 4.0 score of 9.3 (Critical) for CVE-2026-105134 and 5.5 (Medium) for CVE-2026-105133. Those scores come from VulDB, the CNA (the organization that assigned the CVE), not from Ahsay. Treat the pair as critical, since they work together.
  • Exploitation: Listed in CISA’s KEV catalog. CISA’s due date for federal agencies is October 17, 2026. CISA lists ransomware use as unknown. NVD also notes that exploit details have been published.
  • Affected versions: Ahsay’s advisory refers to “affected” v10 and v7/v8/v9 installs without listing exact ranges. NVD’s entries say versions before 10.3.4 are affected, but that predates Ahsay’s October 12 statement that 10.3.4.0 is not enough. Go by Ahsay’s hotfix versions below, not by the NVD range.
  • Workaround: Ahsay’s advisory lists none. The fix is the hotfix plus a reboot.

The fix

If you run Apply Then
AhsayCBS v10 v10.3.4.45 hotfix Reboot the server
AhsayCBS v7, v8, or v9 v9.15.2.70 hotfix Reboot the server

Both hotfixes are on Ahsay’s partner portal, which requires a partner login. If you are a customer of a backup provider rather than a partner, ask your provider whether their server has the hotfix and when it was applied. Get an answer in writing for your records.

What to do today

  1. Find out if you’re exposed. Do you run AhsayCBS yourself, or does a vendor host it for you? Check your backup documentation or ask your provider. Ahsay’s backup agents on your PCs and servers talk to a CBS server, so you may use it without knowing.
  2. Check the version. Sign in to the AhsayCBS admin console and confirm it shows the hotfix build above or later. Ahsay’s release notes for each version are on its site if you need to match a build.
  3. Apply the hotfix and reboot. Take a snapshot or backup of the CBS server itself first if you can, and schedule the reboot outside your backup window.
  4. Limit who can reach it. The web console and backup ports should be open only to the addresses that need them. If you can put the admin console behind a VPN, do it. The firewall review article covers how to find rules that expose more than you intended.
  5. Treat a server that was exposed and unpatched as possibly compromised. CISA marks CVE-2026-105134 as needing forensic triage. Look for admin accounts or backup users you don’t recognize, new scheduled tasks or services on the server, and backup jobs or destinations that changed unexpectedly. If anything looks wrong, stop, isolate the server from the network, and bring in an incident response professional rather than cleaning it yourself. The first-hour guide has the early steps.
  6. Rotate secrets after a real suspicion. If you believe the server was accessed, change the admin passwords and any credentials stored in the backup configuration, such as cloud storage keys and database or hypervisor logins.
  7. Confirm your restore path. Whatever happens, make sure you have a copy of critical data that this server cannot delete or alter. The small office backups article explains why.

Don’t skip the reboot. Ahsay’s advisory says to restart the server after the hotfix, so the fix isn’t fully in place until you do.

If you manage this for a government agency or bank, tell your CSA (CJIS Systems Agency), examiner, or compliance contact according to your own incident process. This article can’t tell you whether a given environment must report anything.

Sources

All articles