[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flQhTdMF2a5cB-xvSdwmfAHwLtl5afEF_x-7uCoZPki0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"38e9db1c-ac35-40f3-90df-cdca6893c44a","unpatched-ahsaycbs-backup-flaws-actively-exploited-for-remote-code-execution","6ae1d8c0-d8a1-47a2-9c54-80a32c5043f4","Unpatched AhsayCBS Backup Flaws Actively Exploited for Remote Code Execution","Attackers are actively exploiting two unpatched vulnerabilities in AhsayCBS — an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134) — to achieve full remote code execution without credentials. The combination of these flaws is particularly dangerous because it requires no authentication, lowering the barrier for widespread exploitation. Threat actors are leveraging access to deploy webshells, cryptominers, and persistent backdoors disguised as legitimate Windows services, compounding the damage beyond initial compromise. This incident highlights the critical risk of exposing unpatched backup infrastructure directly to the internet, as backup systems often hold privileged access to sensitive data and environments.","**Immediate actions:**\n- Restrict all network access to AhsayCBS management interfaces to trusted IP ranges or VPN only until an official patch is available.\n- Audit existing AhsayCBS deployments for signs of compromise, including unexpected webshells, new Windows services, and XMRig processes.\n- Isolate any confirmed or suspected compromised systems from the broader network immediately.\n\n**Long-term improvements:**\n- Establish a formal vulnerability management program that prioritizes internet-facing and backup infrastructure for rapid patching.\n- Maintain an up-to-date inventory of all software and appliances, including version tracking, to enable fast identification of affected systems during active exploits.\n- Implement network segmentation to ensure backup management consoles are never directly reachable from the public internet.\n\n**Detection measures:**\n- Deploy file integrity monitoring and endpoint detection on backup servers to alert on unexpected executable creation or service installation.\n- Enable centralized logging of all authentication attempts and administrative actions on backup systems and forward to a SIEM for real-time alerting.\n- Subscribe to threat intelligence feeds and vendor security advisories to receive early warning of newly disclosed vulnerabilities in critical infrastructure software.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-6: Audit Record Review","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.AC-5: Network Integrity Protected","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1543: Create or Modify System Process",{},"published","2026-10-09T12:22:16.093027+00:00","2026-10-09T12:22:15.804+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.securityweek.com\u002Funpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild\u002F","unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild-ff63f5","Unpatched AhsayCBS Vulnerabilities Exploited in the Wild",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":41,"name":42,"slug":43,"description":44,"color":45},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"449a6262-08e6-4856-84dd-6eda130d127c","2026-10-09","afternoon","ThreatNoir Afternoon Brief — October 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-09\u002Fthreatnoir-afternoon-brief-2026-10-09.mp3",[60,63,66],{"slug":37,"name":61,"problem":62},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":43,"name":64,"problem":65},"Automated patch management","Known holes get closed in days, not months.",{"slug":67,"name":68,"problem":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]