CISA added two AhsayCBS flaws to its Known Exploited Vulnerabilities catalog on 14 October 2026, after attackers were already chaining them against the backup server. The command injection scores CVSS 10. Federal agencies have until 17 October to remediate.

What happened

The two issues sit on the same product and can be used together. CVE-2026-105133 is an improper authentication flaw in the API checkSysPwd function. A remote attacker can manipulate the random argument and skip authentication. The CVE record scores it 7.3 (CVSS 3.1).

CVE-2026-105134 is an operating system command injection in the Replication Receiver component, on /rps/api/json/UpdateReceivers.do, again through the random argument. The CVE record scores it 10 (CVSS 3.1 and 4.0) and says a public exploit exists. CISA lists both as actively exploited and says they can be chained. Known ransomware use is listed as unknown.

The CVE records name AhsayCBS 10.3.0, 10.3.1 and 10.3.2 as affected, and list 10.3.4 as unaffected. That version note is not the current vendor position. On 12 October Ahsay said its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully address either flaw.

Who is affected

• AhsayCBS servers that have not had the 12 October hotfix applied, including boxes already on v10.3.4.0 or v9.15.2.59.
• Managed service providers and backup operators who run AhsayCBS on-premises for client backup sets.
• Internet-reachable consoles and replication receivers are the practical exposure. CISA's required action includes checking whether the asset is exposed.

What to do now

Install the vendor hotfix, reboot, and treat a box that only reached 10.3.4.0 as still exposed.

• On v10, apply AhsayCBS hotfix v10.3.4.45 from the Ahsay partner portal. On v7, v8 and v9, apply hotfix v9.15.2.70. Ahsay says to reboot the server after the hotfix.
• Do not stop at the August 10.3.4 release notes. Ahsay has said those earlier builds did not fully fix these two CVEs.
• After the reboot, look for unexpected files under the Ahsay web application path and for new or changed replication receivers. CISA's KEV entry for the command injection calls for forensic triage, not a patch-and-forget.
• Confirm a recent restore from a destination the backup server itself cannot rewrite. A compromised console can sit on top of the copies you would use to recover.

What this means for South African businesses

Ahsay is not on every South African desk, but it does show up inside MSP backup stacks, including shops that resell branded backup. If a client cannot name the product behind their offsite copies, ask. A CVSS 10 command injection on the server that holds those copies is a worse outcome than a single workstation ransomware hit, because the attacker is already inside the recovery path.

Source: CISA, 14 October 2026, four Known Exploited Vulnerabilities added. Vendor fix notice: Ahsay security alert, 12 October 2026.