Ahsay ships second round of fixes for two chained flaws on backup servers

AhsayCBS has two flaws: an authentication bypass in checkSysPwd (CVE-2026-105133) and a command injection in the Replication Receiver endpoint (CVE-2026-105134) reaching NT AUTHORITY/SYSTEM. Earlier patches 9.15.2.59 and 10.3.4.0 did not fully fix them; hotfixes 10.3.4.45 and 9.15.2.70 arrived on 12 October. CISA added both to its KEV catalog on 14 October with a 17 October deadline.

• CVE-2026-105133 is an auth bypass; CVE-2026-105134 is command injection as SYSTEM
• Huntress saw exploitation from 7 October, with five organisations targeted by 8 October
• Hotfixes: 10.3.4.45 for version 10 and 9.15.2.70 for versions 7–9
• CISA added both flaws to KEV on 14 October with a 17 October due date