AhsayCBS Vulnerability Status Update

Incident Timeline

• 9 October 2026: Ahsay began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS server environments.
• 10 October 2026: Ahsay released hotfix v10.3.4.45 to address the identified vulnerability and notified all partners running AhsayCBS v10 to apply the hotfix immediately.
• 12 October 2026: Ahsay released hotfix v9.15.2.70 to address the identified vulnerability in AhsayCBS v9 and advised all partners using this version to apply the hotfix immediately. Partners operating AhsayCBS v8 and v7 were also advised to upgrade to AhsayCBS v9.15.0.0 and subsequently apply hotfix v9.15.2.70.
• 13 October 2026: Ahsay published guidance and step-by-step instructions to assist partners in identifying potential compromise, assessing affected systems, and performing recovery procedures where necessary .

What does the v9.15.2.70 and v10.3.4.45 hotfixes address?

The v9.15.2.70 and v10.3.4.45 hotfixes fully address the security vulnerabilities identified as CVE-2026-105133 and CVE-2026-105134.

How do I know if my AhsayCBS server has been compromised?

Your AhsayCBS server will be compromised if you observe one or more of the following:

1. Strange folders with names created on the root of your hard drives, for example ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt etc. The time stamp on the folders are typically created on same day but the time may vary.
2. In the %CBS%\webapps folder there may be multiple .jsp files with randomly generated names like 75bc584d292933ad.jsp and or folders with lower case letter and numbers such as xtj7iu, kje74x, 103y9r.
3. There are unauthorized RPS receivers added.
4. The are unauthorized AhsayCBS user accounts with “Admin” type privilege created.

If any of the above indicators are present, Ahsay recommends treating the server as compromised and follow the recommended cleanup and recovery procedures immediately to restore the environment to a known clean state.

What is the recommended cleanup and recovery procedure?

To ensure that your AhsayCBS backup server is completely free from any issues resulting from these security vulnerabilities, Ahsay strongly recommends performing a full rebuild of the backup server.

Recommended recovery steps:

1. Reinstall Windows or Linux on your backup server.
2. Install the latest version of AhsayCBS, v9.15.0.0 or v10.3.4.0 and apply the relevant hotfix version, v9.15.2.70 or v10.3.4.45
3. Restore from Auto Save by recovering a server configuration version whose timestamp predates the compromise. As a best practice, select an Auto Save version from at least one day before the timestamp of any suspicious folders or files created during the unauthorized access incident.

By following the above procedure, administrators can help ensure that the backup server is rebuilt from a known clean state and that any unauthorized modifications associated with the compromise are fully eliminated.