AhsayCBS · Exploitation confirmed

CISA confirms active exploitation of AhsayCBS flaws; hotfixes available

Oct 13, 2026 · 1 min read

CISA added CVE-2026-105134 and CVE-2026-105133, in the AhsayCBS backup software, to its KEV catalog, indicating active exploitation. Ahsay stated on October 12, 2026 that previous patches v9.15.2.59 and v10.3.4.0 did not fully fix the flaws and released hotfixes v10.3.4.45 (v10 line) and v9.15.2.70 (v7, v8 and v9). Apply the matching hotfix and reboot the server.

By HIFY Radar newsroom Updated 10/26/2026 01:29 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CISA added flaws CVE-2026-105134 and CVE-2026-105133 in the AhsayCBS backup software to its KEV catalog, which indicates active exploitation. Ahsay stated on October 12, 2026 that previous patches v9.15.2.59 and v10.3.4.0 did not fully fix the flaws and released new hotfixes.

Why it matters

AhsayCBS stores backups, including customer data. Ahsay itself urges immediate action to secure the environment and protect customer data. Servers left on the old patches remain exposed to active exploitation.

What to do

Apply hotfix v10.3.4.45 on v10 servers and v9.15.2.70 on v7, v8 and v9, both available on the Ahsay partner portal. Reboot the server after applying. Confirm no server remains on patches v9.15.2.59 or v10.3.4.0.

For the technical team

CVE: CVE-2026-105134, CVE-2026-105133
Affected: AhsayCBS · AhsayCBS v7, v8, v9 and v10 without the new hotfixes. Per Ahsay, previous patches v9.15.2.59 and v10.3.4.0 did not fully fix the flaws. NVD refers to the vendor advisory for the version list.
Exploitation: Listed in the CISA KEV catalog, indicating active exploitation of both flaws, CVE-2026-105134 and CVE-2026-105133.
Fix: Hotfix AhsayCBS v10.3.4.45 for the v10 line and v9.15.2.70 for v7, v8 and v9, downloadable from the partner portal (valid login required). Reboot the server after applying.
Vector: Fault type and exploitation preconditions are not described in the sources. The flaws affect the AhsayCBS backup software.
More details: Ahsay published the advisory on October 12, 2026. The NVD record lists 2026-10-14 as the start date. Hotfixes require a valid Ahsay partner portal account.