AhsayCBS: exploited command injection CVE-2026-105134 used to drop Python backdoor

What happened

Two vulnerabilities in AhsayCBS, the backup server software from Ahsay, have been public since 4 October 2026. They are not new, but CISA added both to its catalogue of known exploited vulnerabilities on 14 October 2026. Reports on the attacks describe the flaws being used to install a Python backdoor on servers. Any AhsayCBS server that has not been updated since the disclosure is at risk.

• CVE-2026-105134 (CVSS 10): an OS command injection in the Replication Receiver component. Attackers send a manipulated random argument to /rps/api/json/UpdateReceivers.do, and the attack can be run remotely. A public exploit exists.
• CVE-2026-105133 (CVSS 7.3): improper authentication in the checkSysPwd function of the API (com/ahsay/obs/api/ApiStructsAction.java), also triggered through the random argument and also remotely exploitable. A public exploit exists.

According to the CVE entries, the first patch did not fully fix the problem, so the entries were updated afterwards. The fixed versions are now given as 9.15.2.70 and 10.3.4.45.

Who is affected

You are affected if you run AhsayCBS in one of these versions:

• 9.x up to and including 9.15.2.69
• 10.x up to and including 10.3.4.44

Other products are not affected. If you installed an early patch for these CVEs but are not yet on 9.15.2.70 or 10.3.4.45, assume your server is still vulnerable.

What to do now

1. Check which AhsayCBS version you run, either in the web management console or in the installation directory.
2. Back up your AhsayCBS configuration.
3. Update to 9.15.2.70 (9.x branch) or 10.3.4.45 (10.x branch) or later. Check the Ahsay advisory linked below for download links and any extra steps.
4. Restart the AhsayCBS service and make sure that backups and replication work again.
5. Until the update is installed, block access to the AhsayCBS web and API ports from the internet, or limit it to known IP addresses. Replication endpoints in particular should not be open to everyone.
6. Your server may have been attacked before you updated, so check it for signs of a compromise as described below. If you find a backdoor, treat the server as compromised. Rebuild it from a known clean state and change all passwords and API credentials stored on it or used by it.

How to check whether you are affected

• Version: any version below 9.15.2.70 or 10.3.4.45 is vulnerable.
• Web and access logs: search for requests to /rps/api/json/UpdateReceivers.do, especially from unknown IP addresses or with unusual content in the random parameter. Look at activity since 4 October 2026 at the latest.
• Processes and files: look for unexpected Python processes, recently created Python scripts or executables, and new scheduled tasks, cron jobs or services on the AhsayCBS server.
• Network: check for outgoing connections from the server to unknown hosts.
• Accounts: review the administrator and user accounts in AhsayCBS and on the operating system for entries you did not create.

CISA does not give details about the attacks. For indicators of compromise, see the security reports linked below.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-105133
• https://nvd.nist.gov/vuln/detail/CVE-2026-105134