# SZB-db01d072ad: Attackers exploit AhsayCBS flaws to deploy sandbox-evading Python backdoor

Researchers disclosed an attack that chained CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to bypass authentication and run arbitrary commands, then deliver a Python-based implant. Huntress observed the activity in October 2026, and the flaws are reported as now patched.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Ahsay
- Product: AhsayCBS
- Status: Confirmed
- Sources: 2 distinct
- First seen: 2026-11-10 16:12 UTC
- Confirmed: 2026-11-10 16:12 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Update AhsayCBS to the patched version that fixes CVE-2026-105133 and CVE-2026-105134
- Check AhsayCBS logs for unexpected authentication bypasses and command execution
- Search systems for the Python implant and review any unfamiliar processes or scheduled tasks
- Restrict external access to AhsayCBS management interfaces until patched

## Timeline

- 2026-11-10 16:00 UTC: Made public by The Hacker News
- 2026-11-10 16:12 UTC: First seen by cve.now
- 2026-11-10 16:12 UTC: Confirmed as CVE-2026-105133

## Evidence (2 sources)

- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html): “The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems.”
- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@Analyst207/117593187554086187): “In a sophisticated attack, hackers exploited vulnerabilities in AhsayCBS to deploy a sneaky Python backdoor, using the compromised backup servers as a launching pad for further malicious activity.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-db01d072ad&body=https%3A%2F%2Fcve.now%2FSZB-db01d072ad%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-db01d072ad

### Has Ahsay confirmed it?

Yes. Confirmed as CVE-2026-105133.

Source: https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html, https://mastodon.social/@Analyst207/117593187554086187

### What should Ahsay users do?

Update AhsayCBS to the patched version that fixes CVE-2026-105133 and CVE-2026-105134. Check AhsayCBS logs for unexpected authentication bypasses and command execution. Search systems for the Python implant and review any unfamiliar processes or scheduled tasks. Restrict external access to AhsayCBS management interfaces until patched.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-105133 and CVE-2026-105134.

Source: https://cve.now/CVE-2026-105133, https://cve.now/CVE-2026-105134

## Tracked as

- [CVE-2026-105133](https://cve.now/CVE-2026-105133.md)
- [CVE-2026-105134](https://cve.now/CVE-2026-105134.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-db01d072ad
Site guide for agents: https://cve.now/llms.txt