Attackers exploit AhsayCBS flaw to run system commands without logging in

What happened

Attackers are abusing a flaw in AhsayCBS, Ahsay's cloud backup server, to run operating system commands on exposed servers. The bug sits in the Replication Receiver component, in an API endpoint that updates receiver settings. One of its request parameters is not handled safely, so a crafted value can slip commands through to the underlying system.

No login or user interaction is needed, and the attack works over the network. Ahsay's first patch did not fully close the hole, and the CVE entry was later revised to reflect that. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 14 October 2026.

Who is affected

Ahsay AhsayCBS (Cloud Backup Suite) is affected in two release lines: all versions before 9.15.2.70, and versions from 10.1.0 up to but not including 10.3.4.45. Servers that received the earlier, incomplete fix may still be vulnerable if they are not on one of the corrected versions.

How serious is it

The flaw carries a CVSS 4.0 score of 10.0, the highest possible rating. An unauthenticated attacker who reaches the service can take over the server and affect connected systems as well. Because a backup server holds copies of an organization's data, a compromise here can expose a large amount of sensitive information. Active exploitation is confirmed, and CISA required US federal agencies to address it by 17 October 2026.

What you should do

1. 1Update AhsayCBS to version 9.15.2.70 or 10.3.4.45, depending on your release line.
2. 2Check that servers patched earlier actually run one of these versions, since the first fix was incomplete.
3. 3Apply Ahsay's mitigations as described in its advisory, and stop using the product if they cannot be applied.
4. 4Review which AhsayCBS servers are reachable from the internet and follow CISA's forensics triage guidance for them.

Quick facts