Attackers Are Hitting Backup Servers: AhsayCBS Flaws Under Active Attack

Your backup system is meant to be the thing that saves you on your worst day. Right now, a widely used backup console is being turned into the open door instead, and the latest update does not fully close it.

Security researchers have confirmed that two flaws in AhsayCBS, a backup management console, are being exploited in the wild. Chained together, CVE-2026-105133 (an authentication bypass) and CVE-2026-105134 (an OS command injection) let an attacker on the internet skip the login and run commands on the server with System privileges, no password required. Exploit code was already public when the flaws were disclosed on 4 October, and Huntress reports that by 8 October at least five organisations had been hit, with attackers planting web shells, a cryptominer disguised as Microsoft Edge, and a persistent Windows service to hold their ground.

Why a backup box is the worst thing to lose

Here is the part that should make every business owner sit up. For years the attacker's playbook was to break in, then hunt down and wipe the backups so you could not recover without paying. Going straight for the backup console does both jobs in one move: it hands them a foothold and it quietly kneecaps your recovery before any ransomware even lands. AhsayCBS is popular with managed service providers and integrators that back up data on behalf of lots of small businesses, which means one exposed console is not one company's problem, it is every client's backups sitting behind the same unlocked door. That is exactly the kind of single point of failure we treat as a crown jewel in Australian client environments, not plumbing.

What to do right now

• Get the console off the public internet. With no complete patch available, the only reliable fix is to restrict the AhsayCBS web interface to trusted IP addresses or behind a VPN. Do not leave it internet-facing.
• Don't assume the update saved you. Version 10.3.4 is the latest build and researchers say it is still exploitable, so treat an updated-but-exposed server as still at risk.
• Hunt for compromise. Check for unknown web shells in the application directory, a service or binary masquerading as Microsoft Edge or Edge Update, and unexpected cryptominer activity. Assume breach on any server that was exposed.
• Ask your IT provider directly. If someone else runs your backups, ask them today what backup platform they use and whether its management console is exposed to the internet.

Written by Michael Sacco, All IT Services. All IT is a Sydney-based managed IT provider supporting hospitality, not-for-profit and wealth management businesses across Australia.