Huntress has reported active exploitation of two AhsayCBS backup-management vulnerabilities, CVE-2026-105133 and CVE-2026-105134. Reporting says the flaws can be chained to bypass authentication and execute operating-system commands on exposed systems.
As of October 8, at least five organizations had reportedly been targeted. Observed post-exploitation activity included webshell deployment, reconnaissance, cryptomining and persistence masquerading as Microsoft Edge-related software. AhsayCBS 10.3.4 was also reported as affected.
Immediate containment priorities
- Restrict the management interface to trusted administration networks or VPN.
- Investigate exposed hosts for unexpected JSP files, new services and suspicious processes.
- Review privileged account use and recovery infrastructure for signs of compromise.
- Track vendor guidance; do not assume a future update alone resolves a prior intrusion.
Backup platforms are especially sensitive targets because they can hold powerful credentials and affect recovery operations.
Source: SecurityWeek, citing Huntress (October 9, 2026).