AhsayCBS Backup Exploit: The Question for Your NC Provider

If someone else runs your offsite backup, there are four questions to send them now, and they are in the box further down. If you only have time for one line from your phone, send this: "Do you run AhsayCBS anywhere in the service you sell us? If so, what is its full version and hotfix number (at least v10.3.4.45 on version 10 or v9.15.2.70 on versions 7 to 9, plus the follow-up hotfix Ahsay's October 22 advisory calls for), was the server rebooted, and can its management page be reached from the open internet? In writing, please."

"We upgraded to 10.3.4" does not answer that, and Ahsay itself is the reason. Here is why.

TL;DR: On October 8, 2026, the security firm Huntress reported attackers chaining two flaws in AhsayCBS, the server console behind Ahsay's backup software, to take full control of the server. Huntress saw the first exploitation at 23:20 UTC on October 7 and five organizations targeted by October 8. On October 9 Ahsay said servers on version 10.3.4.0 were not affected; on October 10 it said 10.3.4.0 "did not fully address" the flaws and told its partners to apply hotfix v10.3.4.45 and reboot. On October 12 Ahsay added that its v9.15.2.59 patch also fell short and that servers on versions 7, 8 and 9 need hotfix v9.15.2.70. On October 13 Ahsay said those two hotfixes "fully address" both CVEs. On October 14 CISA added both flaws to its list of actively exploited vulnerabilities. On October 22 Ahsay issued a further "security hardening" hotfix that it told partners on versions 8, 9 and 10 to apply (its advisory numbers it both v10.3.4.54 and v10.3.5.54), with v10.3.6, which Ahsay said was scheduled for the following week, and a separate v9 hotfix to follow for servers that must stay on version 8 or 9. The hotfixes are behind Ahsay's partner login, so whoever runs the server, usually your provider, has to install them, and a server already broken into needs more than a patch.

What happened to AhsayCBS in October 2026?

Two flaws went public on October 4 and were under attack three days later. The NVD record for CVE-2026-105133 describes an authentication weakness in AhsayCBS "up to 10.3.2," with a CVSS 4.0 score of 5.5. The NVD record for CVE-2026-105134 is the dangerous one, with a CVSS 4.0 score of 9.3, critical: it lets an outsider slip their own commands into a part of the server called the Replication Receiver. Both records say exploit code has been published and "may be used."

Huntress's October 8 write-up describes the chain. The first flaw gets the attacker past the login. The second runs their commands as SYSTEM, the built-in Windows account with full control of the machine. Starting at 23:20:15 UTC on October 7, which was 7:20 on a Wednesday evening in High Point, Huntress watched attackers use it against internet-exposed servers. By October 8 it had seen five organizations targeted.

Who runs AhsayCBS matters for everything that follows. Huntress says it "is primarily used by managed service providers (MSPs) and system integrators," and that it "centralizes control of backup operations, letting administrators create and manage users, configure backup policies, and more." In plain terms: a 70-person plant in Thomasville probably does not own an AhsayCBS server. The company that sells it offsite backup might.

Key takeaway: AhsayCBS is usually the provider's console, not your software. If you buy cloud backup from an IT company, the exposed server, if there is one, is probably theirs, and so is the fix; your job is to get a straight answer. If your own IT team runs AhsayCBS, the hotfix and every check on this page are yours to do.

Why isn't "we're on 10.3.4" a good enough answer?

Because for one day the vendor said it was, and then said it was not. A provider who answered you in good faith on Friday, October 9, could be wrong by Saturday, October 10.

The NVD record for CVE-2026-105134 reads: "Upgrading to version 10.3.4 is able to resolve this issue." In an update dated 6 p.m. ET on October 8, Huntress wrote: "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities." The next day, Ahsay's October 9 clarification told partners that those "who have already upgraded to v10.3.4.0 are no longer affected." On October 10, Ahsay's security alert reversed that: "our previous patch v10.3.4.0 did not fully address" both CVEs.

So the version that matters is four digits long. "10.3.4" covers both the release Ahsay now says fell short and the hotfixes it says to apply, and the same is true of "9.15.2" on older servers. The floor is 10.3.4.45 or 9.15.2.70, which Ahsay said on October 13 "fully address" both CVEs; on October 22 it asked partners to go further and apply a newer v10 hotfix, with a separate v9 hotfix to follow for servers that must stay on version 8 or 9. Ask for the full number, and ask whether the server was rebooted afterwards, because Ahsay's alert says "After applying the hotfix, please reboot your server."

Two more things the alert makes plain. The hotfix sits behind Ahsay's partner portal: "A valid partner portal login account is required." If a provider runs your backup console, you cannot fix this yourself; the provider has to. And a patch does not undo a break-in. Ahsay's own October 9 note says that if a server "was compromised prior to upgrading," the upgrade "would not resolve any issues arising from the compromise." The attack window opened on October 7, three days before Ahsay announced the v10 hotfix and five days before the v9 one.

What did the attackers actually do once they were in?

They mined cryptocurrency and hid it well. That sounds minor, but the access that ran a miner could have run anything.

Per Huntress, the attackers planted web shells (small back doors in the web application) in some intrusions, and in others installed a cryptocurrency miner (XMRig, which mines Monero), renamed to look like Microsoft Edge and kept running by a fake Edge update service with SYSTEM rights. A script paused the miner whenever someone opened Task Manager, and in one case they loaded a legitimate but vulnerable driver to give the miner deeper access to the hardware. The Hacker News reported the same chain on October 9.

Huntress reported miners. It did not report deleted backups or stolen data, and we are not claiming either. We think the miner is the least harmful thing that could have landed on that server. Somebody running commands as SYSTEM on the machine that manages backup policies could, with that access, change retention or remove restore points. A miner pegs a processor and somebody eventually hears the fan; a careful attacker would make less noise.

Huntress's recovery advice points the same way. If indicators turn up, it says organizations "should carry out a full host re-image from a trusted backup; as attackers have been able to hide secondary backdoors for extended persistence."

So where does the backup of the backup server live? If the honest answer is "on the same box," that is a design problem worth knowing about before the day you need it.

If you would rather someone put these questions to your provider for you, or check the answer, Preferred Data Corporation has run IT out of High Point since 1987, and our backup and data protection work starts with exactly this conversation. Call (336) 886-3282.

How do I find out if my backup touches Ahsay at all?

Ask, because you may not be able to tell by looking. Ahsay sells rebranding: its site advertises a "Build My Branded CBS Installer Service," and Ahsay's 10.3.4 release notes mention "the availability of re-branding option" for "any v10 branded AhsayCBS/OBM/ACB installer." The backup agent on your file server or ERP server may carry your provider's logo and never say Ahsay.

Ahsay's own site names its client products AhsayOBM and AhsayACB, so the About screen or the install folder of your backup agent may give a clue. So may the sender of your nightly "backup succeeded" email, which names a portal that may be the console or sit in front of it. A line item for "cloud backup" on an IT invoice means somebody runs a server that collects your data. None of these proves Ahsay is or is not involved; only your provider can say for sure.

What should a North Carolina manufacturer do first?

Send one email, then grade the answer. If a provider runs the server, the fix is theirs, but a failed restore is yours. If your own IT team runs AhsayCBS, use the same four questions as their checklist.

Send this:

"Following the October 8 Huntress report and Ahsay's October 10, 12 and 22 notices on CVE-2026-105133 and CVE-2026-105134: (1) Does any part of the backup service you provide us run on AhsayCBS? (2) If yes, what is its full version number, is it on at least hotfix v10.3.4.45 (version 10) or v9.15.2.70 (versions 7 to 9), have you applied the hotfix Ahsay issued on October 22 (or, if the server must stay on version 8 or 9, when you will apply the separate v9 hotfix Ahsay said would follow), and was the server rebooted afterwards, and can its management interface be reached from the internet or only from a VPN or a fixed list of IP addresses? (3) Have you checked those servers for the indicators of compromise Huntress published, and what did you find? (4) Where is the copy of our backups that the AhsayCBS server itself cannot delete?"

Questions 1 and 2 tell you whether you are exposed now. The third asks whether they have looked for signs of a break-in, using the list Huntress published. The fourth is ours, not Huntress's, and it is the one we care about most.

Grade it like this:

A restore point that the provider's console cannot reach turns a compromised console into an inconvenience instead of a lost restore. That can be immutable storage, meaning backup copies that cannot be changed or deleted until a set date, or a copy held elsewhere. Then test a restore: if you have never restored from it, you do not know it works, and now is a good time to find out.

For a plant in the Piedmont Triad, what a backup protects is concrete: the ERP database, the CAD and CNC program files, the quality records your biggest customer audits. If your provider cannot answer four plain questions about where that lives, treat that as the answer.

Is this an argument for dropping your MSP?

No. It is an argument for asking better questions of whoever you use, us included.

Buying backup "as a service" did not move the risk off your books. It moved the server out of your sight. October 2026 showed the cost of that: one console holds many customers' recovery, and until the provider installs a fix only it can download, every customer on it shares the exposure. We made the same point in September about the N-able N-central remote-management attacks, and when Veeam had its own backup-server flaw in June the lesson was the same: isolate the backup server.

On October 14, CISA added both CVEs to its federal list of actively exploited flaws, the Known Exploited Vulnerabilities catalog, with a due date of October 17 for federal agencies. That date has passed. Until your provider confirms the hotfix in writing, treat it as overdue.

If you would rather your provider raised this before you had to ask, PDC is headquartered in High Point, works on-site within 200 miles, and delivers remotely to clients across the US and around the world, with managed IT and cybersecurity under one contract. Call (336) 886-3282 or ask for a backup review.

Frequently Asked Questions

What is AhsayCBS?

AhsayCBS (Cloud Backup Server) is the server-side management console for Ahsay's backup software. Huntress says it is primarily used by managed service providers and system integrators to manage users, set backup policies and run backup operations.

Is AhsayCBS 10.3.4 safe from CVE-2026-105134?

Not version 10.3.4.0, according to Ahsay itself. Ahsay said on October 9 that partners on 10.3.4.0 were no longer affected, then said on October 10 that 10.3.4.0 "did not fully address" both CVEs and told partners to apply the v10.3.4.45 hotfix and reboot. On October 12 it said the same of its v9.15.2.59 patch and named v9.15.2.70 as the hotfix for versions 7 to 9. Huntress had reported on October 8 that 10.3.4 was also affected. On October 13 Ahsay said v10.3.4.45 and v9.15.2.70 "fully address" both CVEs, and on October 22 it issued a further hardening hotfix for partners on versions 8 to 10, with a separate v9 hotfix to follow for servers that must stay on version 8 or 9.

Were any backups deleted in these attacks?

Huntress has not reported that. It reported web shells, a hidden cryptocurrency miner, a fake Edge update service and a vulnerable Windows driver. The concern is that the same SYSTEM-level access would allow much worse. Huntress recommends re-imaging compromised hosts from a trusted backup because attackers have been able to hide secondary backdoors.

How do I know if my company uses Ahsay?

Ask your backup provider directly. Ahsay offers rebranding, so the agent on your servers may carry the provider's name. Checking the installed program's About screen or install folder, and the sender of your nightly backup report, can give you clues, but only the provider can say for sure.

What should my provider do right now?

Per Ahsay's alerts: apply at least the v10.3.4.45 hotfix on version 10, or the v9.15.2.70 hotfix on versions 7, 8 and 9 (Ahsay says v7 and v8 servers first upgrade to v9.15.0.0), and reboot. On October 22 Ahsay told partners on versions 8, 9 and 10 to move to its newer v10 hotfix or wait for v10.3.6, and said that for servers that must stay on version 8 or 9 because of operating system limits, a separate v9 hotfix was expected early the following week. Per Huntress: restrict management interface web access to trusted IP addresses or a VPN, check for the published indicators of compromise, and re-image any host where they are found, because attackers have been able to hide secondary backdoors. We would add one more step: confirm that at least one copy of your backups is out of the console's reach.

Is this on CISA's Known Exploited Vulnerabilities list?

Yes. CISA added both CVE-2026-105133 and CVE-2026-105134 to the catalog on October 14, 2026, with a due date of October 17 for federal agencies. CISA sets that due date for federal agencies, but it is a useful marker for everyone else: it has passed.

Related Resources

• Backup and Data Protection Services - Where your backups live, who can delete them, and proof they restore
• Managed Cybersecurity for NC Businesses - We read vendor advisories and act on them
• Managed IT for NC Businesses - One accountable owner for every server, theirs and yours
• MSP remote tools hacked again: the N-able N-central attacks
• Veeam CVE-2026-44963: when the backup server is the target
• Immutable backups for North Carolina businesses
• How to test a backup restore properly
• Contact Preferred Data Corporation - 1208 Eastchester Drive, Suite 131, High Point, NC 27265. (336) 886-3282