Vulnerabilities · 2 days ago

AhsayCBS attackers query Veeam credentials after compromise

Huntress now says attackers who exploited two AhsayCBS flaws in October 2026 also queried compromised servers for Veeam credentials. The intrusions used an authentication bypass and unauthenticated command execution to plant five web-shell families, two cryptocurrency miners, tunneling tools and a custom Python implant. Ahsay released fixes in mid-October.

The Veeam query changes the scope: operators treated the backup server as a place to look for keys to another backup platform. The available reporting does not establish that they obtained or used those credentials. The hotfix closes the entry points, but it cannot remove tools or an implant already on the host, or undo any credential exposure.

If AhsayCBS could access Veeam or domain credentials in your environment, fixing the initial flaws does not by itself settle whether a separate backup system is exposed—or whether the compromised server can still be trusted.

CVE-2026-105133

NVD KEV

Known exploited · CISA KEV

CVSS 7.3 HIGH: a vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. EPSS 84% (100th percentile).

CISA federal remediation date Oct 17 · date passed

CVE-2026-105134

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: a flaw has been found in Ahsay AhsayCBS up to 10.3.2. EPSS 82% (100th percentile).

CISA federal remediation date Oct 17 · date passed

Timeline

Nov 10 Reported by The Hacker News
Nov 9 Reported by Huntress Blog
Oct 17 CISA federal deadline for CVE-2026-105133 passed
Oct 14 CVE-2026-105133 added to CISA KEV

Sources

2 sources covering this story

The Hacker News Nov 10
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Attackers chained two now-patched AhsayCBS flaws to deploy web shells, XMRig miners, and a Python backdoor tied to its host.
Huntress Blog Nov 9
Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant | Huntress
Follow-up on AhsayCBS intrusion: new webshells, a second miner, and a host-bound Python implant found on exploited backup servers.

Entities

CVE-2026-105133
CVE-2026-105134

Part of the PlainSec briefing for 2026-11-11

Editions

Vulnerabilities · 2 days agoAhsayCBS attackers query Veeam credentials after compromiseHuntress now says attackers who exploited two AhsayCBS flaws in October 2026 also queried compromised servers for Veeam credentials. The intrusions used an authentication bypass and unauthenticated command execution to plant five web-shell families, two cryptocurrency miners, tunneling tools and a custom Python implant. Ahsay released fixes in mid-October.The Veeam query changes the scope: operators treated the backup server as a place to look for keys to another backup platform. The available reporting does not establish that they obtained or used those credentials. The hotfix closes the entry points, but it cannot remove tools or an implant already on the host, or undo any credential exposure.If AhsayCBS could access Veeam or domain credentials in your environment, fixing the initial flaws does not by itself settle whether a separate backup system is exposed—or whether the compromised server can still be trusted.