AhsayCBS CVE-2026-105133 / CVE-2026-105134 exploited: 10.3.4.0 patch failed, webshells and XMRig miner. Which hotfix fixes it and how do I check my backup server?

What it is: two AhsayCBS (Ahsay backup server) flaws chained by attackers: CVE-2026-105133, an authentication weakness in the checkSysPwd API, and CVE-2026-105134, an OS command injection in the Replication Receiver (CVSS 9.3). Together they give remote command execution as NT AUTHORITY\SYSTEM on Windows. Exploitation was seen from October 7, 2026. Ahsay confirmed on October 10 that version 10.3.4.0 did NOT fully fix them. CISA added both to the KEV catalog on October 14, 2026. Am I affected? Any AhsayCBS v10 server below the 10.3.4.45 hotfix, or v9 below the 9.15.2.70 hotfix, especially if the web console or replication port is reachable from the internet. Being on 10.3.4.0 is not enough. Fix: - v10: install hotfix 10.3.4.45 and reboot the server. - v9: install hotfix 9.15.2.70. - Until patched, block internet access to the console and Replication Receiver (allow only known client and replication IPs). Check for compromise (reported indicators): - A new Windows service named MicrosoftEdgeUpdateSvc that is not the real Edge updater. - edge.exe or msedge.exe in temporary or unusual folders (observed as an XMRig miner and a modified service tool); compare paths and hashes with genuine Microsoft files. - Unexpected .jsp files in the AhsayCBS web application folders (webshells). - Unusual child processes of cbssvcX64.exe / cbssvcX86.exe, such as cmd.exe or PowerShell, or downloads. - Sustained high CPU on the backup server. If compromised: isolate the host, remove the service and files, rotate the AhsayCBS admin and system passwords and any credentials or encryption keys held on the server, and check that backups were not altered or deleted. Sources: https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/ https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html https://www.esecurityplanet.com/news/news-ahsaycbs-patch-fails-two-exploited-vulnerabilities/