grep -rl "CVE-2026-105134" ./articles
Ahsay has confirmed that the build it shipped for two exploited backup-server flaws did not address them. A hotfix exists and Huntress has verified it. We reported on 12 October that no patch was available, which was already wrong by two days — this is why.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
CISA added this identifier to its Known Exploited Vulnerabilities catalog on 2026-10-14, which means the agency has evidence of exploitation rather than a judgement that exploitation is possible. US federal agencies were required to remediate it by 2026-10-17.
Ahsay has confirmed that the build it shipped for two exploited backup-server flaws did not address them. A hotfix exists and Huntress has verified it. We reported on 12 October that no patch was available, which was already wrong by two days — this is why.
Huntress saw attackers chaining two AhsayCBS flaws into SYSTEM-level code execution on 7 October, three days after NVD published them. There is no patch, every version through 10.3.4 is affected despite earlier reporting, and the remediation advice is to re-image from a trusted backup.
../cve — every identifier we have covered