AhsayCBS: when the backup console is the target

On October 14, 2026, CISA added two flaws in AhsayCBS, a backup platform, to its KEV catalog. Security firm Huntress had been seeing them exploited since October 7. The detail that matters: Huntress writes that AhsayCBS is used mostly by managed service providers. An MSP's backup console is the last line of defence of dozens of clients at once.

What the sources say

Huntress (October 8, updated). The two flaws are CVE-2026-105133, a medium-severity authentication bypass in the checkSysPwd function, and CVE-2026-105134, a critical command injection reached through the Replication Receiver API, which "can be exploited to achieve unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host". Huntress saw exploitation from October 7, 2026 at 23:20 UTC and counted, as of October 8, five organisations targeted.

After the intrusion: JSP webshells in the application directory, a PowerShell script hiding the miner from Task Manager, a modified NSSM binary for persistence, an XMRig miner disguised as "edge.exe" and a vulnerable kernel driver.

On versions, Huntress writes that "AhsayCBS versions up through 10.3.4 are affected", including 10.3.4.0, first reported as not vulnerable. On October 12, Ahsay released a hotfix: v10 versions should apply hotfix 10.3.4.45, which Huntress says it verified, and versions 7 to 9 hotfix 9.15.2.70.

CISA (October 14). Both flaws are in the KEV catalog, as "Ahsay AhsayCBS Improper Authentication Vulnerability" and "Ahsay AhsayCBS Command Injection Vulnerability", with an October 17 due date for US federal agencies.

Why it matters

The attackers seen here installed a cryptominer. That is the mildest scenario. The same access, as SYSTEM on the console that runs the backups, lets an attacker read every client's data, delete the copies, or encrypt them before launching ransomware on the workstations. Backups are what make refusing to pay possible; a compromised console takes that choice away.

The second lesson is about the fix. The first version announced as fixed was not. A team that ticked "done" on 10.3.4.0 was still exposed until October 12.

The chain also needs no credentials. The first flaw bypasses authentication and the second runs commands through an API meant for replication between servers, an interface many operators never think of as exposed. A console that answers from the internet is enough.

What we think at Sentrix

1. Take the console off the internet. Huntress recommends restricting the management interface to trusted addresses or the VPN. It is the immediate step, before the fix itself.
2. Apply the right fix: 10.3.4.45 for v10, 9.15.2.70 for versions 7 to 9. Check the exact number, not just "up to date".
3. Hunt for compromise, then re-image the host at the slightest indicator, as Huntress recommends. Our incident response service can run that check.
4. Test a restore from an offline or immutable copy that the console cannot erase. That is the subject of our article on the backup that holds.
5. Put the backup console in the inventory of exposed assets, at the same rank as a VPN. That is what the continuous exposure (CTEM) module keeps current.

For an MSP, every client should know, in its own words, where its copies are and who can delete them. Write it into the contract and the monthly report.

The next step

If you run AhsayCBS, or a backup service that uses it, ask today for the exact installed version, the date of the fix and the result of the compromise check. If you want to run that check with us, contact us.