SINGAPORE-BASED Ahsay Backup has issued updated security patches for AhsayCBS to address two flaws that have been observed in the wild being exploited to deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, can be chained to bypass authentication and allow remote command execution on affected systems.
The flaws were previously thought to be fixed in AhsayCBS releases 9.15.2[.]59 and 10.3.4[.]0 (August 2026), but Ahsay has since confirmed that these patches did not completely plug the attack chain. The new fixes are available in AhsayCBS v10.3.4.45 hotfix and v9.15.2.70 hotfix.
Huntress had earlier reported threat actors combining the two flaws to achieve unauthenticated remote code execution and to deploy web shells and miners on exposed systems, and has since independently verified that the 10.3.4[.]45 hotfix mitigates the initial entry point that remained vulnerable on earlier v10 releases.
The issue has drawn the attention of US authorities, with CISA adding these vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog and mandating patching for federal agencies by 17 October 2026. Organisations running AhsayCBS should reboot servers after applying the hotfix, and verify that secure configurations are in place to prevent re-exploitation.