Ahsay told partners on 10 Oct that AhsayCBS 10.3.4.0 did not fully fix CVE-2026-105133 and CVE-2026-105134, which Huntress says attackers chained. Apply hotfix 10.3.4.45, then reboot.
Ahsay told partners on 10 Oct that version 10.3.4.0 of its AhsayCBS backup server “did not fully address” CVE-2026-105133 and CVE-2026-105134. It says affected v10 partners should apply hotfix 10.3.4.45 from its partner portal and then reboot. Security firm Huntress says attackers began exploiting the flaws on 7 Oct, chaining an authentication bypass with a command injection flaw to run commands as SYSTEM, drop web shells and install a cryptominer. Huntress says it saw five organizations targeted as of 8 Oct, a count from its own visibility rather than a total, and that it independently verified that 10.3.4.45 blocks the entry point. No attacker has been named. As of Tuesday morning the flaws were not in CISA’s Known Exploited Vulnerabilities catalog. Huntress has published indicators of compromise.