Cybersecurity firm Huntress has issued a warning about the active exploitation of two significant vulnerabilities in the AhsayCBS backup solution, a tool widely used by managed service providers and system integrators. These vulnerabilities, identified as CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and execute operating system commands remotely. Despite being disclosed on October 4, these flaws remain unpatched, affecting all versions up to 10.3.4. Attackers have been observed chaining these vulnerabilities to gain unauthorized access to systems and execute arbitrary code, targeting at least five organizations as of October 8. The attackers have employed tactics such as deploying webshells, cryptominers, and persistent services masked as legitimate processes to maintain access and control. Huntress advises restricting access to the AhsayCBS management interface and using VPNs or trusted IP addresses to mitigate risks while waiting for a patch. The vulnerabilities' severity underscores the need for immediate action to protect affected systems from further exploitation.