AhsayCBS CVE-2026-105133 and CVE-2026-105134: unauthenticated RCE chain

Two Ahsay Cloud Backup Suite flaws — CVE-2026-105134 (CVSS 10.0) and CVE-2026-105133 (7.3) — chain into unauthenticated command execution on the backup server. CISA added both to its KEV catalog with an October 17, 2026 deadline; the first hotfix at 10.3.4.0 was incomplete, with corrected builds at 10.3.4.45 and 9.15.2.70.

• CVE-2026-105134 scores 10.0, CVE-2026-105133 scores 7.3
• Chain combines an auth defect with command injection
• Initial hotfix 10.3.4.0 was confirmed incomplete
• Web shells and XMRig miner found in three intrusions