AhsayCBS CVE-2026-105133 and CVE-2026-105134: The Backup Server as an Attack Platform

Two vulnerabilities in the Ahsay Cloud Backup Suite, CVE-2026-105134 and CVE-2026-105133, allow attackers to execute commands on the backup server without authentication. The vulnerabilities, reported in October 2026, are rated with CVSS scores of 10.0 and 7.3, respectively. Both vulnerabilities share a parameter name and exploit the backup server's accessibility and availability as a business requirement.

The first vulnerability is an authentication defect, while the second is a command injection. These flaws were added to the Known Exploited Vulnerabilities catalog by CISA, with a federal remediation deadline of October 17, 2026. Ahsay released hotfixes to address the vulnerabilities, but the first hotfix was later found to be incomplete.

Organizations that patched early and removed the issue from their tracking lists may still be vulnerable. Compromised hosts have been observed to deploy web shells and install cryptocurrency miners, such as XMRig. The combination of a web shell and a cryptocurrency miner indicates that attackers aim for both persistence and immediate revenue.

A backup server with a web shell can be used for data exfiltration, altering retention, deleting recovery points, and accessing stored credentials. Mining malware on an internet-facing server within a trusted network segment should be treated as evidence of successful unauthenticated command execution. Practical verification steps include checking the exact Ahsay build, searching for web shell artifacts, checking for miner processes, reviewing backup job history for configuration changes, and testing recent recovery points.

Organizations should consider putting the backup server on a management segment, restricting inbound access to the agent population, and treating its administrative interface like a domain controller's.