Attackers exploit AhsayCBS flaws to deploy sandbox-evading Python backdoor
Researchers disclosed an attack that chained CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to bypass authentication and run arbitrary commands, then deliver a Python-based implant. Huntress observed the activity in October 2026, and the flaws are reported as now patched.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- Ahsay
- Product
- AhsayCBS
- Status
- Confirmed
- First seen
- Confirmed
What to do
Update AhsayCBS to the patched version that fixes CVE-2026-105133 and CVE-2026-105134
Check AhsayCBS logs for unexpected authentication bypasses and command execution
Search systems for the Python implant and review any unfamiliar processes or scheduled tasks
Restrict external access to AhsayCBS management interfaces until patched
Timeline
- Made public by The Hacker News
- First seen by cve.now
- Confirmed as CVE-2026-105133
Evidence 2
- PressThe Hacker News
“The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems.”
- SocialMastodon
“In a sophisticated attack, hackers exploited vulnerabilities in AhsayCBS to deploy a sneaky Python backdoor, using the compromised backup servers as a launching pad for further malicious activity.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-db01d072ad
Has Ahsay confirmed it?
Yes. Confirmed as CVE-2026-105133.Source: The Hacker News, Mastodon
What should Ahsay users do?
Update AhsayCBS to the patched version that fixes CVE-2026-105133 and CVE-2026-105134. Check AhsayCBS logs for unexpected authentication bypasses and command execution. Search systems for the Python implant and review any unfamiliar processes or scheduled tasks. Restrict external access to AhsayCBS management interfaces until patched.
Does it have a CVE?
Yes. It is tracked as CVE-2026-105133 and CVE-2026-105134.Source: CVE-2026-105133, CVE-2026-105134