[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYibdOY6elkjKd9Iei31ACIKcYLy7H_rNdOXluyHT-Xo":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"6ae1d8c0-d8a1-47a2-9c54-80a32c5043f4","Unpatched AhsayCBS Vulnerabilities Exploited in the Wild","unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild-ff63f5","The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. The post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.","Attackers are actively exploiting two unpatched vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in the AhsayCBS backup solution to achieve remote code execution. These flaws allow for authentication bypass and OS command injection, enabling threat actors to deploy webshells, cryptominers (XMRig), and achieve persistence using disguised Windows services. Huntress warns that all versions up to 10.3.2, and even 10.3.4, are affected, recommending access restrictions until a patch is available.","Unpatched AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134 are being exploited in the wild.","https:\u002F\u002Fwww.securityweek.com\u002Funpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-10-09T10:23:42+00:00","2026-10-09T12:00:26.385657+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":22},"Ahsay Systems","vendor",{"name":24,"type":19},"XMRig",{"name":26,"type":19},"NSSM",{"name":28,"type":19},"WinRing0x64.sys",{"name":30,"type":22},"Huntress","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61,63],{"type":56,"value":57,"context":58},"cve","CVE-2026-105133","AhsayCBS vulnerability allowing RCE",{"type":56,"value":60,"context":58},"CVE-2026-105134",{"type":48,"value":24,"context":62},"Cryptominer deployed by attackers",{"type":48,"value":64,"context":65},"webshell","Deployed by attackers after exploitation",[21,30,18],{"controls":68,"vendors":156},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":128,"name":129,"problem":130,"products":131},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[157],{"slug":158,"name":30,"logo_path":159,"roles":160},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":180},"unpatched-ahsaycbs-backup-flaws-actively-exploited-for-remote-code-execution","Unpatched AhsayCBS Backup Flaws Actively Exploited for Remote Code Execution","Attackers are actively exploiting two unpatched vulnerabilities in AhsayCBS — an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134) — to achieve full remote code execution without credentials. The combination of these flaws is particularly dangerous because it requires no authentication, lowering the barrier for widespread exploitation. Threat actors are leveraging access to deploy webshells, cryptominers, and persistent backdoors disguised as legitimate Windows services, compounding the damage beyond initial compromise. This incident highlights the critical risk of exposing unpatched backup infrastructure directly to the internet, as backup systems often hold privileged access to sensitive data and environments.",[167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-6: Audit Record Review","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.AC-5: Network Integrity Protected","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1543: Create or Modify System Process",{}]