What it is
AhsayCBS is the server side of a backup system: your computers send their files to it every night. Many managed IT providers run one and resell backups to dozens of small businesses from it.
CVE-2026-105133 lets an attacker get past the login on the server’s API. CVE-2026-105134, scored a maximum 10.0, lets an attacker inject operating system commands through the Replication Receiver component. Chained, they mean someone on the internet can run commands on the backup server without a password. The NVD records also note the exploit is public and that “the initial patch did not fix the security vulnerability properly,” so a server patched early may still need the later build.
Why a backup server is a bad one to lose
A backup server holds a copy of everything from every client it serves, and it’s the thing you count on after ransomware. An attacker who controls it can read the files, delete the backups, or both, right before the attack that makes you need them.
Three questions for your IT provider
- Do our backups go to an AhsayCBS server?Ahsay is often sold under the provider’s own brand name, so ask about the software, not the product name on the invoice.
- Is it on 9.15.2.70 or 10.3.4.45 or later, and since when?Earlier fixes weren’t complete, so the exact build number matters.
- Do we have a copy that server can’t touch?A second, offline or immutable copy is what saves you if the backup server itself is taken. If there isn’t one, that’s worth fixing this month regardless.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.