CVE-2026-105133
Known exploited · CISA KEV
CVSS 7.3 HIGH: a vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. EPSS 84% (100th percentile).
CISA federal remediation date Oct 17 · date passed
Vulnerabilities & Exploits · Zero-Day Exploit
Huntress now says attackers who exploited two AhsayCBS flaws in October 2026 also queried compromised servers for Veeam credentials. The intrusions used an authentication bypass and unauthenticated command execution to plant five web-shell families, two cryptocurrency miners, tunneling tools and a custom Python implant. Ahsay released fixes in mid-October.
The Veeam query changes the scope: operators treated the backup server as a place to look for keys to another backup platform. The available reporting does not establish that they obtained or used those credentials. The hotfix closes the entry points, but it cannot remove tools or an implant already on the host, or undo any credential exposure.
If AhsayCBS could access Veeam or domain credentials in your environment, fixing the initial flaws does not by itself settle whether a separate backup system is exposed—or whether the compromised server can still be trusted.
2 sources · Nov 10
Known exploited · CISA KEV
CVSS 7.3 HIGH: a vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. EPSS 84% (100th percentile).
CISA federal remediation date Oct 17 · date passed
Known exploited · CISA KEV
CVSS 10 CRITICAL: a flaw has been found in Ahsay AhsayCBS up to 10.3.2. EPSS 82% (100th percentile).
CISA federal remediation date Oct 17 · date passed
The Hacker News
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Attackers chained two now-patched AhsayCBS flaws to deploy web shells, XMRig miners, and a Python backdoor tied to its host.
originalHuntress Blog
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant | Huntress
Follow-up on AhsayCBS intrusion: new webshells, a second miner, and a host-bound Python implant found on exploited backup servers.
originalPart of the PlainSec briefing for 2026-11-11
Every edition of this story: AhsayCBS attackers query Veeam credentials after compromise