Your MSP's Backup Software Is Being Actively Hacked Right Now
Your backup software is being actively attacked. Not in a theoretical, “patch it when you get round to it” way. In a “multiple organisations have already been compromised and attackers had a ten-day head start before CISA published” way.
On the 14th of October 2026, the US Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalogue, all confirmed as actively exploited in the wild. Two of them sit inside software that your managed service provider may be using right now to look after your backups. A third sits inside email security infrastructure. All three carry direct consequences for UK small businesses, even if your name doesn’t appear anywhere in the vendor’s advisory.
This briefing covers the three most relevant items for businesses operating with 5 to 50 employees and an MSP relationship. It does not cover everything on the list. Everything on the list does not matter equally.
Story One: The Backup Software Your MSP Uses Has Been Compromised Since 4th October
Ahsay Cloud Backup Server, known as AhsayCBS, is the management console at the heart of Ahsay’s backup product suite. It is used primarily by managed service providers and system integrators to administer backup policies, run backup jobs, and restore data on behalf of their clients. If your MSP offers managed backup, there is a meaningful probability they are running AhsayCBS somewhere in their infrastructure.
Two vulnerabilities were added to CISA’s KEV catalogue on the 14th of October 2026, and the Dutch security outlet Security.NL confirmed that active exploitation began no later than the 4th of October 2026: ten days before CISA’s confirmation.
CVE-2026-105133 is an improper authentication vulnerability. An attacker can manipulate the random parameter in the API component’s checkSysPwd function to bypass authentication entirely, gaining access to the AhsayCBS system without valid credentials.
CVE-2026-105134 is a command injection vulnerability that chains directly onto the authentication bypass. Once inside, an attacker can manipulate the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint to execute arbitrary operating system commands remotely.
That sequence matters. Step one: bypass authentication. Step two: run whatever commands you like on the underlying server. The two CVEs are documented as chainable, and the evidence from Security.NL is that attackers were chaining them against real targets before most MSPs had any awareness of the vulnerabilities.
Ahsay has since released a hotfix. The requirement from CISA is straightforward: apply the vendor’s mitigations immediately, or discontinue use of the product if mitigations are unavailable.
Why this lands on your desk, not just your MSP’s:
If an attacker gains control of your MSP’s backup management console, they can do several things that directly affect you. They can modify or delete your backup data, removing your ability to recover from a ransomware attack. They can use the server as a staging point to reach client environments. They can exfiltrate backup data, which typically contains sensitive business information, customer records, and financial data, often more comprehensively than a production system would.
Backup infrastructure is a high-value target precisely because it is trusted. It has access to everything. And it is frequently less scrutinised than production systems.
The exploitation window here was at least ten days. Multiple organisations were compromised during that window, according to the Security.NL reporting. Some of those organisations may not yet know.
Story Two: Cisco Secure Email Gateway, Unauthenticated File Writes, Active Exploitation
Cisco confirmed on the 14th of October 2026 that CVE-2026-76519 is being actively exploited in the wild. The vulnerability is a relative path traversal flaw in Cisco Secure Email Gateway that allows an unauthenticated remote attacker to write arbitrary files to the underlying operating system.
Breaking that down: no login required. An attacker on the internet, with no credentials whatsoever, can write files onto the operating system of a device that is specifically deployed to protect your email.
The Hacker News reported that the attack condition involves File Reputation being enabled and scanner tools being in an outdated state. CISA’s required action is the same as with Ahsay: apply vendor mitigations in accordance with Cisco’s instructions, ensuring compliance with BOD 26-04 patching guidelines, or discontinue use if mitigations are unavailable.
Cisco Secure Email Gateway is enterprise infrastructure. The businesses most directly exposed are those running on-premises Cisco email security appliances, and the MSPs and managed security service providers who operate that infrastructure on their clients’ behalf. If your email security is managed by a third party, the question of whether their Cisco infrastructure is patched is a legitimate one to ask.
The broader pattern here is consistent with what we have seen across 2026: email security infrastructure, VPN appliances, and backup management consoles are priority targets. They sit at perimeters and trust boundaries. Compromising them gives attackers footholds that are difficult to detect and from which lateral movement is straightforward.
Story Three: What October Patch Tuesday Tells You About the Volume Problem
Slightly separate in nature but worth flagging: Microsoft’s October 2026 Patch Tuesday release included 1,414 patches, the first time in the product’s history that the monthly patch count has reached four digits. Kaspersky’s analysis noted this milestone specifically.
This is not a Microsoft-specific observation. It is a system-wide one. The volume of vulnerabilities being discovered, catalogued, and patched is accelerating. The operational burden of staying current is increasing. For businesses relying on MSPs to manage this on their behalf, the question is not whether your MSP is aware of Patch Tuesday. The question is whether their patching cadence is actually keeping pace with the volume, and whether you have any visibility into whether it is.
A monthly patching cycle that made sense in 2018 may be materially inadequate in 2026. The data supports that conclusion.
How This Gives You an Edge Over Competitors Who Are Not Paying Attention
Most SMBs in the UK have no visibility into what software their MSP runs on their behalf. They receive a monthly invoice, occasional reports, and a reassurance that everything is fine. When a vulnerability like the Ahsay chain emerges and attackers have a ten-day exploitation window, the businesses that ask specific questions get specific answers. The businesses that assume their MSP has it covered find out differently, often during an incident.
Having a documented list of the software your MSP uses in your environment, and a standing agreement that you are notified within 24 hours of a critical vulnerability affecting that software, is a procurement differentiator. It signals to your clients and your supply chain partners that your security posture is governed, not assumed.
If you work in a sector where clients ask security questionnaires before awarding contracts, being able to demonstrate active oversight of MSP-managed infrastructure is a concrete, verifiable answer to a question that most of your competitors will fumble.
Making the Business Case
Three arguments for getting this in front of whoever holds the budget:
The liability argument. Under UK GDPR, you are the controller. Your MSP is the processor. If your MSP’s infrastructure is compromised and your client data is exfiltrated as a result, the ICO’s investigation starts with you. The fact that it was your MSP’s software does not transfer the liability. It transfers the awkwardness of the conversation.
The backup argument. The specific risk with the Ahsay vulnerabilities is that attackers can modify or destroy backup data. If your primary recovery mechanism is compromised, the cost of a ransomware attack is not the ransom. It is the full cost of rebuilding from scratch. Quantify that for your organisation and compare it to the cost of a quarterly review call with your MSP.
The timing argument. Attackers had a ten-day window on the Ahsay vulnerabilities before CISA published. That is not unusual. That is the gap between exploitation in the wild and public disclosure. Businesses that are asking questions proactively close that gap. Businesses that wait for their MSP to call them do not.
What to Do Before the End of This Week
1. Ask your MSP directly whether they use AhsayCBS. The specific question is: “Do you run Ahsay Cloud Backup Server in your environment, and if so, have you applied the hotfix for CVE-2026-105133 and CVE-2026-105134?” If they do not know what AhsayCBS is, that is a data point.
2. Ask whether any of your data passed through their backup infrastructure between 4th October and 14th October 2026. This is the exploitation window. If they use Ahsay and were unpatched during that period, you are entitled to know whether a forensic review of their environment has been conducted.
3. If your email security is managed externally, ask specifically about Cisco Secure Email Gateway and CVE-2026-76519. The question is whether the appliance is patched and whether any anomalous file writes were detected in the period prior to patching.
4. Request a software inventory of the tools your MSP operates on your behalf. This is a reasonable contractual ask. You should know what software has access to your data and your systems. If your MSP resists providing this, that resistance is itself information.
5. Check your own WordPress installations. If you run a WordPress site, review the plugins listed in today’s NVD critical CVEs. CVE-2026-110002 affects the Snazzy Social Media Feed plugin (versions up to and including 2.5), allowing arbitrary file upload leading to remote code execution. CVE-2026-97668 affects Abandoned Cart Pro for WooCommerce (versions up to and including 10.8.0) via SQL injection. CVE-2026-104800 affects the AGE-GATE plugin (versions up to and including 1.0) with unauthenticated remote code execution. CVE-2026-104748 affects SimpleForm (versions up to and including 3.10.0) with privilege escalation possible for unauthenticated users. If you are running any of these plugins, update or remove them immediately.
None of these steps require a budget conversation. They require a phone call and the willingness to ask a direct question and hold for a direct answer.
If you found this useful, the podcast episode covering today’s brief goes into the Ahsay chain in more detail. Follow the show on whatever platform you use, leave a rating or review if you have a moment, drop a comment with your questions or pushback, and if you know a business owner who outsources their IT and has never asked their MSP what software they actually run, send this to them. It costs nothing to ask the question. It costs considerably more not to.