CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability | Cyberiack

Skip to content

Actively exploited: added to CISA’s KEV catalog on October 14, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: October 17, 2026.

Description from CISA’s KEV catalog.

Our analyses

AhsayCBS: Two Flaws Exploited, Ahsay Releases New Patch After First Fix Failed

Since October 7, hackers have been exploiting two vulnerabilities in the AhsayCBS backup server. Version 10.3.4.0 did not fix them: Ahsay is urging customers to install patch 10.3.4.45.

Oct 12, 20262 min read

What to do

Check whether your estate includes AhsayCBS, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (www.ahsay.com)
NVD entry (NIST)
CISA KEV catalog

Other Ahsay vulnerabilities

CVE-2026-105133Oct 14

Ahsay AhsayCBS Improper Authentication Vulnerability