Announcements

Incident Timeline

• 9 October 2026: Ahsay began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS server environments.
• 10 October 2026: Ahsay released hotfix v10.3.4.45 to address the identified vulnerability and notified all partners running AhsayCBS v10 to apply the hotfix immediately.
• 12 October 2026: Ahsay released hotfix v9.15.2.70 to address the identified vulnerability in AhsayCBS v9 and advised all partners using this version to apply the hotfix immediately. Partners operating AhsayCBS v8 and v7 were also advised to upgrade to AhsayCBS v9.15.0.0 and subsequently apply hotfix v9.15.2.70.
• 13 October 2026: Ahsay published guidance and step-by-step instructions to assist partners in identifying potential compromise, assessing affected systems, and performing recovery procedures where necessary .

What does the v9.15.2.70 and v10.3.4.45 hotfixes address?

The v9.15.2.70 and v10.3.4.45 hotfixes fully address the security vulnerabilities identified as CVE-2026-105133 and CVE-2026-105134.

How do I know if my AhsayCBS server has been compromised?

Your AhsayCBS server will be compromised if you observe one or more of the following:

1. Strange folders with names created on the root of your hard drives, for example ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt etc. The time stamp on the folders are typically created on same day but the time may vary.
2. In the %CBS%\webapps folder there may be multiple .jsp files with randomly generated names like 75bc584d292933ad.jsp and or folders with lower case letter and numbers such as xtj7iu, kje74x, 103y9r.
3. There are unauthorized RPS receivers added.
4. The are unauthorized AhsayCBS user accounts with “Admin” type privilege created.

If any of the above indicators are present, Ahsay recommends treating the server as compromised and follow the recommended cleanup and recovery procedures immediately to restore the environment to a known clean state.

What is the recommended cleanup and recovery procedure?

To ensure that your AhsayCBS backup server is completely free from any issues resulting from these security vulnerabilities, Ahsay strongly recommends performing a full rebuild of the backup server.

Recommended recovery steps:

1. Reinstall Windows or Linux on your backup server.
2. Install the latest version of AhsayCBS, v9.15.0.0 or v10.3.4.0 and apply the relevant hotfix version, v9.15.2.70 or v10.3.4.45
3. Restore from Auto Save by recovering a server configuration version whose timestamp predates the compromise. As a best practice, select an Auto Save version from at least one day before the timestamp of any suspicious folders or files created during the unauthorized access incident.

By following the above procedure, administrators can help ensure that the backup server is rebuilt from a known clean state and that any unauthorized modifications associated with the compromise are fully eliminated.

We would like to inform you that our previous patches v9.15.2.59 and v10.3.4.0 did not fully address the following security vulnerabilities:

CVE-2026-105133
CVE-2026-105134

Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customers data.

• Partners running affected v10 versions should apply the AhsayCBS v10.3.4.45 hotfix, available at: https://www.ahsay.cn/en/hotfix-v10-partner-only (A valid partner portal login account is required)
• Partners running affected v7, v8, and v9 versions should apply the AhsayCBS v9.15.2.70 hotfix, available at: https://www.ahsay.cn/en/hotfix-v9-partner-only (A valid partner portal login account is required)

After applying the hotfix, please reboot your server.

We would like to inform you that our previous patch v10.3.4.0 did not fully address the following security vulnerabilities:

CVE-2026-105133
CVE-2026-105134

Given the severity of these risks, we strongly urge you to take immediate action to secure your environment and protect your customers data.

Partners running affected v10 versions should apply the AhsayCBS v10.3.4.45 hotfix, available at: https://www.ahsay.cn/en/hotfix-v10-partner-only (A valid partner portal login account is required)

After applying the hotfix, please reboot your server.

We have recently received inquiries from various sources regarding the following two vulnerabilities, both of which were addressed in AhsayCBS v10.3.4.0, released on 4 August 2026: 

https://vuldb.com/cve/CVE-2026-105133
https://vuldb.com/cve/CVE-2026-105134

We would like to clarify that partners who have already upgraded to v10.3.4.0 are no longer affected by these vulnerabilities and are protected against remote exploitation by unauthenticated attackers.

However, if your backup server was compromised prior to upgrading to v10.3.4.0, the upgrade itself would not resolve any issues arising from the compromise. In such cases, we strongly recommend engaging qualified cybersecurity professionals to conduct a thorough investigation and perform any necessary remediation activities.

We are pleased to announce the official release of Ahsay v10.3.4 which now supports:

1. Hyper-V backup on Windows 11
2. Hyper-V backup on Windows 10
3. macOS 26.6 (Tahoe)
4. Debian 12.15 and Debian 13.6

Click here to view the full release notes.