Vulnerabilities
Attackers target AhsayCBS backup servers, used by many IT providers, and the first patch wasn't enough
Two flaws in AhsayCBS, the software many providers use to manage their customers' backups, have been exploited since 7 October, and Ahsay has had to redo its patches. If an external provider handles your backups, this is the week to ask them.
Ahsay — Vendor of the affected software (AhsayCBS)
In 30 seconds
- Two AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134), chained together, let an attacker take over the backup server without a password. Huntress detected attacks from 7 October 2026.
- Ahsay acknowledged on 10 and 12 October that its earlier patches (10.3.4.0 and 9.15.2.59) did not close the problem. The valid fixes are hotfixes 10.3.4.45 and 9.15.2.70.
- CISA added both flaws to its catalogue of actively exploited vulnerabilities on 14 October.
- Patching doesn't clean a server that has already been attacked: Ahsay recommends rebuilding it completely if there are signs of intrusion.
Does this affect me?
It affects you if your company buys cloud backup from an IT or managed service provider, because many of them use AhsayCBS to manage it. The affected server is the provider's, not your computers: what you can do is ask them. If you make your own backups with a different program, this flaw doesn't affect you. No Spanish victims have been confirmed.
What happened
AhsayCBS is the software that many managed service providers and integrators use to manage their customers' backups from a central server. Security firm Huntress reported on 8 October 2026 that, since the 7th, it had seen attackers chaining two vulnerabilities in the software: CVE-2026-105133, which allows authentication to be bypassed, and CVE-2026-105134, which allows code to be run on the server with the system's highest privileges.
What came next complicated matters. On 9 October, Ahsay stated that version 10.3.4.0, released on 4 August, already fixed both flaws. On 10 October it corrected itself: that version did not fully fix them, and it asked its partners to install hotfix 10.3.4.45 and restart the server. On 12 October it extended the warning to version 9.15.2.59, which wasn't enough either, and released hotfix 9.15.2.70. On 14 October, the US cybersecurity agency (CISA) added both flaws to its catalogue of actively exploited vulnerabilities.
What we know
- Valid fixes (according to Ahsay): hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for version 9. Anyone still on versions 7 or 8 must first move to 9.15.0.0 and then apply the hotfix. They can only be downloaded from Ahsay's partner portal.
- Observed attacks: Huntress had seen five organisations targeted as of 8 October. The attackers installed backdoors on the server and a cryptocurrency mining program disguised as Microsoft Edge.
- Ahsay began receiving reports from partners on 9 October about unauthorised access to their AhsayCBS servers.
- If the server has already been attacked, Ahsay recommends reinstalling it from scratch and restoring a saved configuration from at least one day before the first suspicious sign. Updating doesn't remove anyone who has already got in.
What we don't know yet
- Whether the attackers have accessed customers' backups. Neither Ahsay nor Huntress says so: what they have described is the takeover of the server and the cryptocurrency mining.
- How many servers have been attacked, beyond the five cases Huntress saw.
- Which version first fixed the flaws. BleepingComputer initially reported that they were fixed in 10.3.2; Ahsay later said 10.3.4.0, and finally that this version wasn't enough either.
- Whether there are victims in Spain. None have been confirmed.
Why it matters
Backups are the last thing left when everything else fails, for example after a ransomware attack. That's why a backup server is a valuable target: whoever controls it can reach the provider's network and, potentially, the information of many customers at once.
The case also leaves an uncomfortable lesson: a patch doesn't always close the problem. Anyone who updated in August and stopped worrying was still exposed.
What it means for an SME
In many SMEs, cloud backup is something the manager buys from their IT provider, often as part of a monthly package. It's common not to know what software sits behind it or where the server is. And you don't need to know: you need to ask. The affected server isn't in your office, but your data may well be on it.
What your company should do this week
- Ask your backup provider whether they use AhsayCBS. If the answer is yes, ask them to confirm they have installed hotfix 10.3.4.45 or 9.15.2.70.
- Ask whether they have checked the server for signs of intrusion from before the fix, as Ahsay recommends, and what they found.
- Run a restore test: ask them to send back a specific file from last week. A backup that has never been tested is not a guarantee.
- Check that you have at least one copy out of that server's reach, offline or with another provider. It's the basis of the 3-2-1 backup rule (in Spanish).
If you don't know for certain who makes your backups, how and where, that's exactly what a cybersecurity audit reviews.
Sources
- Ahsay — «AhsayCBS Vulnerability Status Update» (13 October 2026)Primary source
- Ahsay — «(Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134» (12 October 2026)Primary source
- CISA — four vulnerabilities added to the KEV catalogue (14 October 2026)Primary source
- Huntress — «Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer» (8 October 2026, updated 12 October)
- BleepingComputer — «Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto» (Bill Toulas, 9 October 2026)
Defentria editorial team. The Defentria team selects cybersecurity news from primary sources (CERTs, official bodies and vendors) and explains what it means for a Spanish SME and what to do about it.
