--- title: "Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)" description: If you have already patched, you are not necessarily safe. This advisory explains what to do. image: https://businessinsights.bitdefender.com/hubfs/Technical%20Advisory_%20CVE%20Updates.png --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) ![Technical Advisory\_ CVE Updates](https://businessinsights.bitdefender.com/hubfs/Technical%20Advisory_%20CVE%20Updates.png) [#SMB Security](https://businessinsights.bitdefender.com/topic/smb-security) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) [#Ransomware](https://businessinsights.bitdefender.com/topic/ransomware) [#Threat Research](https://businessinsights.bitdefender.com/topic/threat-research) By [**Martin Zugec**](https://businessinsights.bitdefender.com/author/martin-zugec) / Oct 15, 2026 # Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134) Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134&utm_medium=social&utm_source=facebook) **\[CRITICAL\]** | CVSS 10.0 (CVE-2026-105134, per VulDB) | Active exploitation confirmed, listed in CISA KEV | Patch immediately ## TL;DR Attackers are chaining two vulnerabilities in AhsayCBS, the server-side backup management platform of the Ahsay Cloud Backup Suite: [CVE-2026-105133](https://nvd.nist.gov/vuln/detail/cve-2026-105133), an authentication flaw, and [CVE-2026-105134](https://nvd.nist.gov/vuln/detail/cve-2026-105134), an OS command injection flaw rated CVSS 10.0 by VulDB. Every AhsayCBS v7 to v10 server that an attacker can reach, and that runs a build below v10.3.4.45 (v10) or v9.15.2.70 (v7, v8, v9), is exposed. That includes servers on the earlier patches v10.3.4.0 or v9.15.2.59, which the [Ahsay announcement, October 2026](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update) says did not fully fix the flaws. If you have already patched, you are not necessarily safe: verify the installed build, apply the new hotfix, reboot, and check for prior compromise. Patching closes the entry point but does not remove webshells or other access an attacker has already planted, and that access can sit unused for weeks before a ransomware or data theft attack. Bitdefender MDR has investigated multiple incidents at our customers through this chain since around 7 October 2026. For exact remediation steps, including how to identify affected systems and assess for prior compromise, see [What To Do](https://businessinsights.bitdefender.com/-temporary-slug-2d8c1303-613d-45ff-9984-59206e87d6a8/bookmark://what-to-do?hsLang=en-us) below. ## Advisory History **15 October 2026:** Initial publication, based on three Bitdefender MDR incident investigations. Vendor hotfixes are available, and both CVEs are listed in CISA KEV. ## Situation AhsayCBS is the server side of Ahsay’s backup product. It receives, stores and manages backups for the clients connected to it. Attackers are exploiting two flaws in its web-facing components in the wild. The timeline: - **4 October 2026, 07:16 UTC:** Both CVEs are published in the US National Vulnerability Database (NVD). Both entries state that a public exploit exists. - **Around 7-8 October 2026:** Bitdefender MDR’s first two incidents begin. They coincide with the first public reporting of exploitation and the first Ahsay advisories. - **12 October 2026:** Ahsay releases hotfixes (v10.3.4.45 for v10, v9.15.2.70 for v7, v8 and v9). The same advisory states that the earlier patches, v10.3.4.0 and v9.15.2.59, did not fully address the vulnerabilities. - **14 October 2026:** CISA adds both CVEs to its [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). KEV is the US government’s list of flaws with confirmed in-the-wild exploitation, and federal agencies must fix listed flaws by a set deadline. MDR identifies a third incident the same day. - **17 October 2026:** CISA’s federal remediation deadline. Bitdefender MDR investigations and the KEV listing both confirm exploitation. Some indicators in our incidents overlap with publicly reported activity. We do not attribute this activity to any named actor. The NVD entries still list 10.3.4 as unaffected. The vendor’s later advisory supersedes that statement, and this advisory follows the vendor. ## How it’s Exploited Backup servers are a valuable foothold. They hold credentials for the systems they protect and the storage they write to, and they control the copies an organization relies on to recover. A ransomware operator wants to steal or destroy exactly that data before encrypting anything else. AhsayCBS exposes a management web service so administrators and clients can reach it, so on many deployments the server is reachable from the internet by design. All three incidents Bitdefender MDR investigated began the same way, through a combination of the two CVEs. One flaw breaks authentication. Improper authentication means the server can be tricked into treating an unverified request as legitimate. The other is OS command injection, where text supplied by the attacker is executed as an operating system command on the server. Both NVD entries name the same argument, random, and neither flaw needs an account or any user action. MDR saw the two used together. NVD, however, scores the command injection as needing no privileges on its own, so an attacker may not need the full chain to run commands. A public exploit exists. CISA’s Stakeholder-Specific Vulnerability Categorization (SSVC) is the model CISA uses to prioritize fixes, and it rates exploitation of both flaws as active and automatable. Once inside, the attackers moved to confirm and test their access. In the first incident, they validated access through JSP webshells, which are small scripts planted on a web server that let an attacker run commands through ordinary web requests. They also staged PowerShell payloads, tried to stage payloads as command files (.cmd) in the shared C:\\Users\\Public folder, and tried to establish persistence, meaning a way back in that survives reboots and password changes. MDR analysts detected and blocked portions of this activity early. In the second incident, the attacker deployed JSP files (Java Server Pages, which act as webshells on this Java-based server) and again tried to stage command files in C:\\Users\\Public. The attacker then ran reconnaissance aimed at finding stored credentials, elevated a user account to SYSTEM (the highest privilege level on Windows), and used obfuscated PowerShell commands to install and configure OpenSSH, the standard remote-login service. A working SSH service would give an attacker a way back in that does not depend on the vulnerable web service, which is why patching alone does not end the incident. The attacker tried to establish persistence before being detected. In the third, MDR blocked and remediated the activity early in initial access. MDR credits three things: it identified known clusters of attacker behavior, the customer responded promptly, and configurations were reviewed quickly. After that shared start, the incidents diverged. File names differed, the attackers abused different system tools and binaries, and the apparent objectives did not match. The Bitdefender MDR assessment is that the exploit chain was the constant, while file names, tools, and binaries changed from one incident to the next. Some indicators did overlap between the first two incidents, and the campaign appears to share some infrastructure: the C2 address 38.60.252\[.\]110 was the starting point of the two first incidents. Even so, a hash or file name from one incident may not reliably find the next one. The reliable signal is how the server behaves after the exploit fires. Combined with the differences between incidents, the shared infrastructure suggests a fluid situation in which several different actors may be using the same exploits. That is an assessment, not a finding, and it may change as more incidents surface. **Exposure conditions.** Your server is exposed if two things are true. It runs AhsayCBS v7, v8, v9 or v10 below v9.15.2.70 (v7 to v9) or v10.3.4.45 (v10), and the attacker can reach its management web service. Servers on the earlier patches are not safe. An administrator who patched to v10.3.4.0 or v9.15.2.59 did the right thing at the time, but the vendor now says that fix was incomplete. The question to ask is not “did we patch?” The question is whether the server runs v10.3.4.45 or v9.15.2.70 or later. **Amplifying factors.** VulDB, the CVE Numbering Authority, scores the command injection 10.0 under CVSS 3.1, the industry’s standard severity scale. A public exploit exists, and exploitation is rated automatable. The incomplete first patch leaves administrators believing they are covered. MDR’s assessment is that several actors may be using the chain. The credential reconnaissance in the second incident fits what backup servers hold. **Limiting factors.** Exploitation requires network access to the management web service, so servers reachable only from internal networks carry less realistic exposure. MDR blocked one incident early in initial access and blocked part of the activity in another. MDR saw no encryption, data exfiltration or ransomware deployment. Ransomware remains a plausible risk because of the target type, but MDR did not observe it. **Confidence.** This is observed in the wild, confirmed by first-party MDR investigations and corroborated by the KEV listing. We are not hedging on severity. This is internet-exposed, unauthenticated remote code execution with a public exploit, and in MDR’s assessment several different actors may be using it. That makes it a playbook case: continued opportunistic exploitation of unpatched and earlier-patched servers is near-certain. We are deliberately restrained on everything else. Three incidents cannot establish who is behind this, how many groups are involved, or what they ultimately want. If you have confirmed exposure, skip ahead to [What To Do](https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134#:~:text=a%20stable%20set.-,What%20To%20Do,below%20expand%20on%20the%20immediate%20actions%20summarized%20in%20the%20TL%3BDR.,-1.%20Identify%20Exposure). ## How it Works Public disclosure of the mechanism is limited. Everything below comes from the NVD entries and Bitdefender MDR observations, and nothing here speculates on root cause. Each flaw carries a CWE classification. CWE (Common Weakness Enumeration) is the standard catalog of software weakness types. **CVE-2026-105133 (improper authentication, CWE-287).** The flaw is in the checkSysPwd function of the API component, in ApiStructsAction.java. Manipulating the random argument results in improper authentication. It can be exploited remotely, with no privileges and no user interaction. **CVE-2026-105134 (OS command injection, CWE-77 and CWE-78).** The flaw is in the Replication Receiver component, the offsite store that synchronizes backup data from one or more AhsayCBS servers ([Ahsay, “CBS v9 Replication Guide”, August 2025](https://www.ahsay.com/support/help-centre/cbs/doc/v9/administration/replication)). The affected endpoint is /rps/api/json/UpdateReceivers.do. Manipulating the same random argument leads to OS command injection, again remotely and with no privileges or user interaction. Why is this possible? NVD classifies the two as different weaknesses: improper authentication in CVE-2026-105133 and OS command injection in CVE-2026-105134, both reached by manipulating the random argument. Ahsay has not published why the first patches fell short, and we will not guess. **Scores.** VulDB assigned all scores below as the CVE Numbering Authority (CNA), the organization that issued these CVE IDs. NVD reports them but has not published scores of its own. | CVE | CVSS 3.1 | CVSS 4.0 | | --- | --- | --- | | CVE-2026-105133 | 7.3 High (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) | 5.5 Medium | | CVE-2026-105134 | 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) | 9.3 Critical | The 105134 vector describes a flaw that is reachable over the network (AV:N), has low attack complexity (AC:L), needs no privileges or user interaction (PR:N/UI:N), and has high impact on confidentiality, integrity and availability. The scope change (S:C) means a successful attack affects resources beyond the vulnerable component itself. Neither NVD nor MDR states what privilege level the injected commands run with, and we do not claim one. **Observed staging.** In MDR’s incidents, the attackers staged follow-on PowerShell scripts on a subdomain of a public static-site hosting service. Staging means placing payloads somewhere the compromised server can download them in a later step. The observed URLs were hxxps://captcha-eyw\[.\]pages\[.\]dev/challenges.ps1 and hxxps://captcha-eyw\[.\]pages\[.\]dev/install.ps1. In the first two incidents, the attackers also tried to stage payloads as .cmd files in C:\\Users\\Public, a folder every local user can write to, which makes it a common drop location. In the second incident, obfuscated PowerShell commands installed and configured OpenSSH. This advisory publishes no file hashes or webshell paths, because the MDR data does not support a stable set. ## What To Do The steps below expand on the immediate actions summarized in the TL;DR. ### 1. Identify Exposure List every AhsayCBS server you run, including any a service provider operates for you. Check the installed build on each one. In the AhsayCBS web console, go to System Settings \> License \> Update License, which shows the Product Version. Ahsay documents this path for AhsayCBS 7.5 and above on all platforms ([Ahsay, “KB5009”, September 2025](https://www.ahsay.com/en/support/help-centre/how-to/kb5009)). Versions appear as four-part numbers, for example 9.8.5.1, so compare the full number against v10.3.4.45 or v9.15.2.70. A server is fixed only if it runs v10.3.4.45 or later (v10), or v9.15.2.70 or later (v7, v8, v9). “We already patched” does not answer the question. A server on v10.3.4.0 or v9.15.2.59 has the earlier patch and is still vulnerable. Update it and check it for compromise. Then confirm whether the management web service is reachable from the internet or other untrusted networks. Review the firewall and network address translation (NAT) rules, which map outside addresses to the server, and test from an external vantage point. ### 2. Patch or Mitigate Apply the hotfix for your version from the [Ahsay announcement](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update) (vendor support account may be required): v10.3.4.45 for v10, or v9.15.2.70 for v7, v8 and v9. A hotfix is a targeted update released outside the normal release schedule. Reboot the server afterward, as the same advisory instructs. The announcement lists no workaround. If you cannot apply the hotfix immediately, Bitdefender recommends limiting access to the management web service to known administrative networks until you can. This is our recommendation, not vendor guidance. It reduces exposure but does not remove it. Patching closes the entry point. It does not remove webshells, staged scripts or persistence an attacker has already put in place, so continue to step 3 whatever your patch status. ### 3. Assess for Prior Compromise Search from at least 4 October 2026, the date the CVEs were published in NVD. File names and tools varied between incidents, so hunt for behavior rather than specific artifacts: - New or recently modified JSP or other script files in the AhsayCBS web application directories that you did not deploy - Command shells or PowerShell launched as child processes of the AhsayCBS service - PowerShell downloading scripts from external hosting services, including the staging URLs in [Indicators of Compromise](https://businessinsights.bitdefender.com/-temporary-slug-2d8c1303-613d-45ff-9984-59206e87d6a8/bookmark://indicators-of-compromise?hsLang=en-us) - Command (.cmd) files in C:\\Users\\Public that you did not create - OpenSSH installed or configured on a server that never ran it, especially through obfuscated PowerShell, and user accounts whose privileges changed since 4 October - New Windows services, scheduled tasks or other persistence created on the server since 4 October - Outbound connections from the server to the C2 addresses listed below. C2 (command and control) servers are attacker-run machines that compromised systems contact for instructions. - Access to credential stores or configuration files holding stored passwords If you find signs of compromise, treat the server as untrusted. Rotate the credentials stored on that server or reachable from it: AhsayCBS administrator accounts, credentials for the backup storage destinations it writes to, the service accounts it runs under, and any domain credentials used or cached on the host. This advisory alone is not a reason to rotate credentials that have no path to the server. ### 4. Monitor Ongoing Keep monitoring the server’s behavior after patching: child processes of the backup service, new script files in web directories, files appearing in C:\\Users\\Public, new remote-access services such as OpenSSH, new services and scheduled tasks, and unexpected outbound connections. Bitdefender MDR’s assessment is that several different actors may be using this chain, so a static blocklist from one incident will not cover the next. Keep checking the Ahsay advisory for further updates, because the first fix has already been superseded once. ### 5. Do Not Wait for Something to Happen Quiet is not the same as clean. Our ransomware research describes “delayed attacks”: a gap of days or weeks between initial access and the next stage, and a manual phase that can run for weeks or months after an automated first wave ([Bitdefender TechZone, “Stopping Ransomware”](https://techzone.bitdefender.com/en/white-papers/ransomware-whitepaper.html#UUID-59960c85-1017-9bf3-343d-d586c1744d70_section-idm4633764819124834313362349192)). Initial access brokers, criminals who sell entry to compromised networks, often hand the access to ransomware groups with no link to the original intrusion. A webshell or a new remote-access service that no one has used yet is not harmless: the attacker may be holding the access for later, using it to stage cryptominers, or selling it to another group. Bitdefender MDR has not determined the objective in these incidents, and we do not claim one. Plan on the assumption that an attacker who got in is waiting to use it. So if your server was exposed and unpatched at any point since 4 October 2026, do not treat the absence of visible damage as the all-clear. Complete the compromise assessment in step 3 even if nothing looks wrong, and treat any finding as an active intrusion, not a leftover. ## Indicators of Compromise The indicators below come from Bitdefender MDR incident investigations. They are what we have observed so far and should not be treated as a complete detection list. MDR’s guidance is to rely on post-exploitation behavior rather than static indicators. | Type | Indicator | Description | | --- | --- | --- | | IP | 38.60.252\[.\]110 | Network C2, starting point of the first two incidents | | IP | 13.143.164\[.\]15 | Network C2 | | IP | 45.142.141\[.\]160 | Network C2 | | IP | 74.208.22\[.\]238 | Network C2 | | IP | 167.148.88\[.\]236 | Network C2 | | URL | hxxps://captcha-eyw\[.\]pages\[.\]dev | PowerShell staging URL | | URL | hxxps://captcha-eyw\[.\]pages\[.\]dev/challenges.ps1 | PowerShell staging URL | | URL | hxxps://captcha-eyw\[.\]pages\[.\]dev/install.ps1 | PowerShell staging URL |   ### Explore More Topics - [Enterprise Security (767)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (207)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (195)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (173)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (139)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (136)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (127)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (121)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Threat Intelligence (82)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [IT Compliance & Regulations (75)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (59)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (55)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (47)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (24)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (10)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (6)](https://businessinsights.bitdefender.com/topic/podcast) - [AI (3)](https://businessinsights.bitdefender.com/topic/ai) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [Technical Advisory: Critical Remote Code Execution Vulnerability in Microsoft SharePoint Server (CVE-2025-53770)](https://businessinsights.bitdefender.com/bitdefender-advisory-rce-vulnerability-microsoft-sharepoint-server-cve-2025-53770ce?hsLang=en-us) ### [Bitdefender Threat Debrief | June 2026](https://businessinsights.bitdefender.com/bitdefender-threat-debrief-june-2026?hsLang=en-us) ### [Technical Advisory: React2Shell Critical Unauthenticated RCE in React (CVE-2025-55182)](https://businessinsights.bitdefender.com/advisory-react2shell-critical-unauthenticated-rce-in-react-cve-2025-55182?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender\_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Martin Zugec", "url" : "https://businessinsights.bitdefender.com/author/martin-zugec" }, "dateModified" : "2026-10-15T19:58:52.911Z", "datePublished" : "2026-10-15T19:55:39.000Z", "headline" : "Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)", "image" : [ "https://businessinsights.bitdefender.com/hubfs/Technical%20Advisory_%20CVE%20Updates.png" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```