Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Attackers are actively exploiting two unpatched vulnerabilities in AhsayCBS — an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134) — to achieve full remote code execution without credentials. The combination of these flaws is particularly dangerous because it requires no authentication, lowering the barrier for widespread exploitation. Threat actors are leveraging access to deploy webshells, cryptominers, and persistent backdoors disguised as legitimate Windows services, compounding the damage beyond initial compromise. This incident highlights the critical risk of exposing unpatched backup infrastructure directly to the internet, as backup systems often hold privileged access to sensitive data and environments.