Vulnerability · medium · CVSS 6.9
AhsayCBS flaws exploited to deploy sandbox-evading Python backdoor
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Organisations running AhsayCBS with the two patched flaws
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Exploited in the wild · Public exploit · Remote, no login
What to do
- Confirm that AhsayCBS is updated to a version that includes the patches for the two flaws.
The Brief
- Attackers exploited two AhsayCBS vulnerabilities, now patched, to deliver a Python-based implant.
- Huntress observed the activity in October 2026, and the chain includes CVE-2026-105133.
Why it matters
Organisations running AhsayCBS may have been compromised through a flaw chain that installs a backdoor designed to evade sandbox analysis.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: AhsayCBS is enterprise backup server software that IT and MSP teams run and maintain. |
| No | Core infrastructure | Judgment: a single backup product, not software nearly every team runs like OpenSSH or the Linux kernel. |
| No | Popular tool | Judgment: AhsayCBS is a niche enterprise backup product, not a mainstream widely used developer tool. |
| Yes | Exploited in the wild | CISA SSVCCISA rates exploitation of CVE-2026-105133 as active |
| Yes | Public exploit | CVE.orgCVE-2026-105133 record links an exploit: huntress.com |
| Yes | Remote, no login | CVSSCVE-2026-105133: CVSS 6.9 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | The Hacker News snippet reports no stolen credentials, tokens, configs or customer data. |
| No | Supply chain | The Hacker News: attacks exploited vulnerabilities in AhsayCBS; no compromised package, update or build pipeline is reported. |
| No | No fix yet | The Hacker News: the two vulnerabilities are described as now-patched. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-105133 ↗CVSS 6.9 medium AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
- Exploited
- CISA rates exploitation active
- EPSS
- 84% chance of exploitation in the next 30 days · higher than 100% of all CVEs
- Weakness
- CWE-287
Timeline
Researchers disclosed the attack details
The Hacker News
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Source
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor ↗ The Hacker News · 2h ago
First seen · 1 source · Full story page · How tiers are decided