---
title: AhsayCBS CVE-2026-105133 + CVE-2026-105134 chain exploited since Oct 7; now on CISA KEV | ctxsec
url: https://ctxsec.com/items/ahsay
description: ""
status: "exploited (vendor/researcher), CISA KEV"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ahsay.md)

exploited (vendor/researcher), CISA KEV

2026-10-14

### AhsayCBS CVE-2026-105133 + CVE-2026-105134 chain exploited since Oct 7; now on CISA KEV

Auth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. CISA added both CVEs to KEV on Oct 14 with a federal due date of Oct 17 (BOD 26-04 forensic triage required for CVE-2026-105134).

Sources: [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) · [Ahsay](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)