Critical AhsayCBS Backup Software Flaws Actively Exploited, Prompting Urgent Patch Calls

Security researchers have confirmed that two newly disclosed flaws in AhsayCBS, a widely used backup solution, are being leveraged by threat actors in real‑world attacks. Identified as CVE‑2026‑105133 and CVE‑2026‑105134, the vulnerabilities enable unauthenticated users to bypass login mechanisms and execute arbitrary operating‑system commands on affected servers, effectively granting attackers full control over compromised backup infrastructure.

The first vulnerability, CVE‑2026‑105133, bypasses the product's authentication routine by manipulating request parameters, allowing malicious actors to gain entry without valid credentials. The second, CVE‑2026‑105134, builds on that foothold to inject system commands, opening a path for data exfiltration, ransomware deployment, or lateral movement within corporate networks. Both flaws are classified as critical due to their combined impact on confidentiality, integrity, and availability.

Ahsay Technologies, the vendor behind CBS, released an advisory acknowledging the issues but has yet to publish a definitive patch. In the interim, the company recommends disabling remote access features and applying available mitigations, such as restricting network exposure and enforcing strict firewall rules. SecurityWeek was the first outlet to report that the exploits are already observed in the wild, underscoring the immediacy of the threat.

Industry analysts note that backup platforms are attractive targets because they often store privileged credentials and provide a direct route to critical data. The exploitation of AhsayCBS mirrors a broader trend where attackers prioritize unpatched management tools to establish persistence. Organizations that rely on the software are urged to conduct rapid inventory checks, verify version numbers, and prioritize remediation to avoid becoming entry points for broader compromises.

Looking ahead, experts anticipate that additional exploit kits may surface as more details about the vulnerabilities become public. Vendors are expected to roll out patches in the coming weeks, but the window for attackers remains open. Security teams are advised to monitor threat‑intel feeds for indicators of compromise linked to the CVEs and to incorporate anomaly‑detection controls that can flag unexpected command execution on backup servers.