Swiss SME Cyber Alert: AhsayCBS – actively exploited, hotfix 10.3.4.45 required
Updated: Oct 12
Ahsay has reversed its earlier assurance: AhsayCBS 10.3.4.0 does not fully protect against the actively exploited vulnerabilities CVE-2026-105133 and CVE-2026-105134. Affected v10 servers now require hotfix 10.3.4.45 followed by a restart. If your IT provider uses AhsayCBS for your backups, ask them to confirm the exact build today and check the server for signs of compromise.
What happened?
Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication and run commands with NT AUTHORITY\SYSTEM privileges on reachable AhsayCBS servers. Huntress has observed these attacks since 7 October 2026, including the installation of web shells and XMRig miners.
Ahsay initially stated on 9 October that version 10.3.4.0 addressed the vulnerabilities. On 10 October, the vendor corrected that statement: the earlier patch did not fully resolve the issue. Affected v10 systems must receive hotfix 10.3.4.45 and then be restarted.
Could my company be affected?
Yes, if your business operates AhsayCBS directly or if an IT provider or managed service provider uses it to manage your backups. The platform may be offered under the provider’s own brand, so ask specifically about AhsayCBS.
AhsayCBS v10 systems without hotfix 10.3.4.45 are relevant. A statement that the server is simply on “10.3.4” or “10.3.4.0” is no longer sufficient.
What should you do now?
Ask your IT provider today whether AhsayCBS is in use and which exact build is installed.
Affected v10 servers should receive hotfix 10.3.4.45 and then be restarted, as directed by Ahsay.
The management interface should be accessible only from trusted IP addresses or through a VPN.
If the server was exposed to the Internet before the hotfix, a compromise assessment is also required. Updating does not remove web shells or other persistence that may already be present.
How urgent is it?
Very urgent. The vulnerabilities are being actively exploited and can provide control of the Windows server without valid credentials. Because the previously cited 10.3.4.0 fix was incomplete, systems believed to be patched should also be rechecked immediately.
Information for your IT provider
CVE-2026-105133: authentication bypass in AhsayCBS.
CVE-2026-105134: command execution through the Replication Receiver function; in the observed chain, remote code execution as NT AUTHORITY\SYSTEM.
Current vendor fix for affected v10 systems: AhsayCBS hotfix 10.3.4.45, followed by a server restart.
Version 10.3.4.0 is not considered complete protection following the vendor correction of 10 October 2026.
For earlier Internet exposure, investigate unusual child processes of cbssvcX64.exe or cbssvcX86.exe, unexpected JSP files, newly created services and the IoCs published by Huntress.
