On October 14, 2026, CISA added two Ahsay AhsayCBS CVEs to the KEV catalog, due October 17: CVE-2026-105133, an authentication bypass, and CVE-2026-105134, a command injection. CISA notes they can be chained.
AhsayCBS is a backup server, often run by service providers backing up data for many customers. That's exactly the kind of target you don't leave waiting.
| CVE | Type | CVSS | NVD published | Added to KEV | Due |
|---|---|---|---|---|---|
| CVE-2026-105133 | Authentication bypass (API, checkSysPwd) | 7.3 (HIGH) | 2026-10-04 | 2026-10-14 | 2026-10-17 |
| CVE-2026-105134 | Command injection (Replication Receiver) | 10.0 (CRITICAL) | 2026-10-04 | 2026-10-14 | 2026-10-17 |
Vectors: CVE-2026-105133 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, CVE-2026-105134 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
CISA reports no known ransomware use for either entry.
What the Flaws Do
CVE-2026-105133 affects the checkSysPwd function in the API component. NVD describes it as improper authentication exploitable remotely, and notes that an exploit is public.
CVE-2026-105134 affects the Replication Receiver component. CISA describes it this way:
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands [...]
NVD rates it 10.0, with a scope change (S:C), and also notes a public exploit. On its own, the first carries a moderate score. Together, the scenario is plain: get past authentication with the first, run OS commands with the second. Both KEV entries explicitly point to each other.
Why It Matters: Backups Are the Last Safety Net
The 7.3 on CVE-2026-105133 says nothing about the chain. What counts is what the attacker gets at the end: control of the backup server.
A backup server holds:
- a copy of all data from the machines it protects, often for several customers at a provider
- the means to recover after an incident — so the first thing an attacker wants to neutralise before encrypting or wiping
- credentials and keys to reach sources and storage destinations
Ransomware operators routinely go after backups: deleting backup sets or making them unusable before encrypting production removes every option but paying. Nothing so far shows these two CVEs being used that way — but a compromised backup server enables exactly that.
Versions
For CVE-2026-105133, NVD states that AhsayCBS up to 10.3.2 is affected and that upgrading to 10.3.4 fixes the issue. The CPE bound NVD lists is 10.3.4.
For CVE-2026-105134, NVD gives the same range: up to 10.3.2 affected, 10.3.4 fixes it. One upgrade closes both links of the chain.
Detection
- Access to the AhsayCBS API and console from unusual addresses, or succeeding without a consistent prior login
- Unexpected child processes of the AhsayCBS service: shells, download tools, interpreters
- Undocumented changes to replication settings
- Deleted or altered backup sets, retention policies or storage destinations
- New admin or user accounts
Mitigation
- Upgrade AhsayCBS to 10.3.4 (or later), before the October 17 deadline.
- Take the console and API off the internet where not strictly needed, or filter them by source IP.
- Restrict the Replication Receiver to legitimate replication servers only. If you don't use it, disable it.
- Keep an offline or immutable copy of critical backups, unreachable from the AhsayCBS server itself.
- If in doubt: check backup set integrity, rotate credentials the server holds, and follow the forensic triage procedure CISA asks for.
Why Monitor Your Backup Servers
A backup server doesn't look like an exposed device until you check what it publishes to the internet. When it's the target, the whole organisation's ability to recover is at stake.
With cveo.tech, inventory your backup software with exact versions, and get alerted whenever a CISA KEV CVE affects it.