NewsThe Hacker News15.10.2026SME Finance Public sector

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier

CVE-2026-105134In Ahsay AhsayCBS bis Version 10.
CVE-2026-105134Ahsay AhsayCBS — Ahsay AhsayCBS Command Injection Vulnerability
CVE-2026-105133In Ahsay AhsayCBS bis Version 10.
CVE-2026-105133Ahsay AhsayCBS — Ahsay AhsayCBS Improper Authentication Vulnerability

Other advisories

CriticalCVE-2026-105134AhsayCBS: Betriebssystem-Befehlsinjektion
CriticalCVE-2026-105133AhsayCBS: unzureichende Authentifizierung
CriticalCVE-2026-105134In Ahsay AhsayCBS bis Version 10.
CriticalCVE-2026-105133In Ahsay AhsayCBS bis Version 10.
HighCVE-2022-37027AhsayCBS: Remote Code Execution (RCE)
HighCVE-2022-37027AhsayCBS: Remote Code Execution (RCE)
HighCVE-2020-5846AhsayCBS: Codeausführung
HighCVE-2020-5846AhsayCBS: Codeausführung

Other news entries

NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBSNewsNCSC-NL14.10.2026
Unpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoNewsBleepingComputer09.10.2026
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft EdgeNewsThe Hacker News09.10.2026
Unpatched AhsayCBS Vulnerabilities Exploited in the WildNewsSecurityWeek09.10.2026

Source: https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html

Linked advisories

More on AhsayCBS

Other advisories

Other news entries