Keep the Backup Console Off the Internet: Lessons From the AhsayCBS Attacks

Briefing

Huntress reported that starting October 7, 2026, attackers exploited two AhsayCBS flaws, CVE-2026-105133 (improper authentication) and CVE-2026-105134 (command injection), to run code on backup servers. By October 8 Huntress had seen five organizations targeted, with attackers performing reconnaissance, dropping web shells and planting XMRig cryptominers disguised as Microsoft Edge. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on October 14.

Ahsay released hotfixes on October 12. Huntress lists 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 through 9, and reports that AhsayCBS through 10.3.4 is affected.

AhsayCBS is mostly run by service providers, so many businesses are exposed without knowing the product name. The lesson applies to any backup platform. The console that controls your backups can delete them, and attackers who reach it can stop your recovery before they start anything else. From a network point of view, it belongs behind the firewall with the same access rules as any other administrative system.

What to do

1. Ask your backup provider which platform and version runs your backups, and whether it is AhsayCBS.
2. If it is, confirm the hotfix was applied and ask for the date.
3. Confirm the backup management console is not reachable from the open internet. Limit access to specific management addresses or a zero-trust connector.
4. Keep at least one backup copy that the console cannot delete, such as immutable or offline storage.
5. Put the backup server on its own network segment and restrict which hosts can reach it.

How to verify

• Run an external port scan against your public addresses and confirm no backup console answers.
• Ask your provider for evidence of a hunt for web shells and unknown processes on the backup server after patching.
• Perform a test restore of one file and one full system, and record the time it took.
• In Ares RMM, confirm the backup server reports current patch status and endpoint protection.

Sources

• Huntress, Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer, Oct 2026
• CISA, CISA Adds Four Known Exploited Vulnerabilities to Catalog, Oct 14, 2026
• CISA, Known Exploited Vulnerabilities catalog
• CISA, #StopRansomware Guide

Questions about your phones, network or IT? Contact Texwan.