Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes

Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes

15 October 2026: Ahsay has told its partners that the patches it issued for CVE-2026-105133 and CVE-2026-105134, versions 9.15.2.59 and 10.3.4.0, "did not fully address" the two exploited flaws in AhsayCBS, its backup server. The Singapore company now says hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for versions 7 to 9 fully fix them, and that any server showing signs of intrusion should be rebuilt rather than cleaned.

Not yet independently verified. Ahsay states no severity scores and no count of affected servers, and the hotfix pages sit behind a partner login that we did not read. We will update this when either is published. We will update this when it can be confirmed, and remove this note.

We reported the flaws on 9 October, when no fixed version had been confirmed. Ahsay's own timeline, published on 13 October, fills in what happened next.

How the fixes arrived

• 9 October: Ahsay began receiving reports from partners of unauthorised access to their AhsayCBS servers.
• 10 October: hotfix 10.3.4.45 released for version 10.
• 12 October: hotfix 9.15.2.70 released for version 9. Partners on versions 7 and 8 were told to upgrade to 9.15.0.0 first and then apply it.
• 13 October: Ahsay published guidance on spotting a compromise and recovering.

Both hotfixes are downloads from Ahsay's partner portal and need a partner login. Ahsay asks for a server reboot after applying them. Ahsay sells AhsayCBS through partners, many of whom run it for their own customers, so a business whose backups go to an AhsayCBS server will usually need to ask its provider which build it runs.

Signs that a server was entered

Ahsay lists four indicators, any one of which means the server should be treated as compromised:

• unfamiliar folders at the root of a drive, such as ahsay_ts, ahsay_t8, ahsay_t20, srv, user or opt, typically created on the same day;
• .jsp files with random names in the %CBS%\webapps folder, or folders with short random names of letters and digits;
• RPS receivers that nobody added;
• AhsayCBS user accounts with Admin privilege that nobody created.

Why Ahsay asks for a full rebuild

Patching closes the hole but does not remove what an intruder left behind. Ahsay's recovery procedure is to reinstall Windows or Linux on the backup server, install AhsayCBS 9.15.0.0 or 10.3.4.0 and apply the matching hotfix, and then restore the server configuration from an Auto Save copy dated at least a day before the earliest suspicious file or folder. A backup server holds credentials and copies of every client's data, which is why a quiet foothold there is worth the trouble of starting again.

We list Ahsay. Our server backup software category lists 20 products, among them Vembu BDR Suite, NovaBACKUP Server, Vinchin Backup & Recovery and Cohesity.

Update, 22 October 2026: CISA added CVE-2026-105133 and CVE-2026-105134 to its catalogue of exploited vulnerabilities on 14 October, with a due date of 17 October for US federal agencies, and notes that the two can be chained. Ahsay's own announcement of 21 October confirms unauthorised access incidents from 9 October.

Related on TrustList:

• AhsayCBS backup flaws exploited to plant miners, no patch confirmed
• Veeam fixes a critical authorization bypass in Backup & Replication 13
• Singapore fines Singtel S$1m over March mobile outages

Sources

• Ahsay: (Update) Critical Security Alert, Immediate Action Required for CVE-2026-105133 and CVE-2026-105134, 12 October 2026
• Ahsay: AhsayCBS Vulnerability Status Update, 13 October 2026
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-105133, CVE-2026-105134) - 14 October 2026
• Ahsay: Announcements - 21 October 2026