CISA adds two Ahsay AhsayCBS flaws to the KEV catalog

CISA has added two Ahsay AhsayCBS backup-server flaws (CVE-2026-105133 and CVE-2026-105134) to the Known Exploited Vulnerabilities catalog. Chained together, an authentication bypass and a command injection give an unauthenticated attacker remote code execution as SYSTEM.

Exploitation has been observed since October 7. Backup servers are high-value targets because they hold the keys to recovery; exposed AhsayCBS instances should be patched and reviewed first.

Sources: CISA, SecurityWeek, Horizon3.ai