Announcements

As part of our ongoing commitment to enhancing the security and resilience of Ahsay solutions, we are pleased to announce the release of AhsayCBS v10.3.5.54 hotfix. This update includes significant security hardening enhancements designed to further strengthen the platform's security posture.

We strongly recommend that all partners take immediate action to apply the latest hotfix and ensure their AhsayCBS environments remain adequately protected.

Alternatively, partners who prefer not to deploy the hotfix separately may wait for the upcoming AhsayCBS v10.3.6 release, which is scheduled for next week. These security enhancements will be incorporated into the official installer and available as part of the standard release.

All partners running affected v8, v9, or v10 versions should upgrade to the latest AhsayCBS v10.3.4.54 official hotfix, available at: https://www.ahsay.com/en/hotfix-v10-partner-only

For partners who need to continue using AhsayCBS v8 or v9 due to operating system compatibility limitations, a separate official AhsayCBS v9 hotfix is expected to be available early next week.

On 9 October, 2026, we began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS servers. From the moment the issue was identified, our team acted with urgency and focus.

• A hotfix was developed and released within 24 hours to immediately close the backdoor to prevent further exploitation.
• Partners were notified immediately and provided with guidance.

Our priority was, and continues to be, protecting our partners, and their customers.

Our short-term commitment: Complete resolution

Any newly discovered issues arising from the remediation process will be addressed as quickly as possible. We will not consider this matter closed until all identified concerns have been addressed and our partners have the confidence they need to continue serving their customers.

Our long-term commitment: Stronger security for the future

As the threat landscape continues to evolve, cybercriminals are increasingly employing AI-powered techniques to accelerate and enhance the exploitation of vulnerabilities. This is a challenge faced by software vendors across all industries, and this incident reflects that broader reality rather than an issue unique to Ahsay.

To further enhance our security posture, additional safeguards for both version 9 and 10 are already planned and will be rolled out as part of our continuous security improvement strategy. These enhancements are designed to strengthen resilience of Ahsay solutions against emerging cyber threats, including increasingly sophisticated AI-powered attacks.

Moving forward together

We always stand with our partners.

Challenges such as these serve as an important reminder that cybersecurity requires constant vigilance. By responding swiftly, learning continuously, and investing in stronger defenses, we can further strengthen our resilience and emerge even better prepared for the future.

Thank you for your continued trust, partnership, and support.

Together, we will continue to grow with greater confidence, stronger security, and a shared commitment to protecting the businesses and customers who rely on us every day.

Incident Timeline

• 9 October 2026: Ahsay began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS server environments.
• 10 October 2026: Ahsay released hotfix v10.3.4.45 to address the identified vulnerability and notified all partners running AhsayCBS v10 to apply the hotfix immediately.
• 12 October 2026: Ahsay released hotfix v9.15.2.70 to address the identified vulnerability in AhsayCBS v9 and advised all partners using this version to apply the hotfix immediately. Partners operating AhsayCBS v8 and v7 were also advised to upgrade to AhsayCBS v9.15.0.0 and subsequently apply hotfix v9.15.2.70.
• 13 October 2026: Ahsay published guidance and step-by-step instructions to assist partners in identifying potential compromise, assessing affected systems, and performing recovery procedures where necessary .

What does the v9.15.2.70 and v10.3.4.45 hotfixes address?

The v9.15.2.70 and v10.3.4.45 hotfixes fully address the security vulnerabilities identified as CVE-2026-105133 and CVE-2026-105134.

How do I know if my AhsayCBS server has been compromised?

Your AhsayCBS server will be compromised if you observe one or more of the following:

1. Strange folders with names created on the root of your hard drives, for example ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt etc. The time stamp on the folders are typically created on same day but the time may vary.
2. In the %CBS%\webapps folder there may be multiple .jsp files with randomly generated names like 75bc584d292933ad.jsp and or folders with lower case letter and numbers such as xtj7iu, kje74x, 103y9r.
3. There are unauthorized RPS receivers added.
4. The are unauthorized AhsayCBS user accounts with “Admin” type privilege created.

If any of the above indicators are present, Ahsay recommends treating the server as compromised and follow the recommended cleanup and recovery procedures immediately to restore the environment to a known clean state.

What is the recommended cleanup and recovery procedure?

To ensure that your AhsayCBS backup server is completely free from any issues resulting from these security vulnerabilities, Ahsay strongly recommends performing a full rebuild of the backup server.

Recommended recovery steps:

1. Reinstall Windows or Linux on your backup server.
2. Install the latest version of AhsayCBS, v9.15.0.0 or v10.3.4.0 and apply the relevant hotfix version, v9.15.2.70 or v10.3.4.45
3. Restore from Auto Save by recovering a server configuration version whose timestamp predates the compromise. As a best practice, select an Auto Save version from at least one day before the timestamp of any suspicious folders or files created during the unauthorized access incident.

By following the above procedure, administrators can help ensure that the backup server is rebuilt from a known clean state and that any unauthorized modifications associated with the compromise are fully eliminated.

We would like to inform you that our previous patches v9.15.2.59 and v10.3.4.0 did not fully address the following security vulnerabilities:

CVE-2026-105133
CVE-2026-105134

Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customers data.

• Partners running affected v10 versions should apply the AhsayCBS v10.3.4.45 hotfix, available at: https://www.ahsay.com/en/hotfix-v10-partner-only (A valid partner portal login account is required)
• Partners running affected v7, v8, and v9 versions should apply the AhsayCBS v9.15.2.70 hotfix, available at: https://www.ahsay.com/en/hotfix-v9-partner-only (A valid partner portal login account is required)

After applying the hotfix, please reboot your server.

We would like to inform you that our previous patch v10.3.4.0 did not fully address the following security vulnerabilities:

CVE-2026-105133
CVE-2026-105134

Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customers data.

Partners running affected v10 versions should apply the AhsayCBS v10.3.4.45 hotfix, available at: https://www.ahsay.com/en/hotfix-v10-partner-only (A valid partner portal login account is required)

After applying the hotfix, please reboot your server.