CISA Flags Exploited Backup Software: Can Your Business Continuity Plan Survive an Attack?

What Happened to AhsayCBS Backup Software?

On October 14, CISA confirmed active exploitation of two AhsayCBS vulnerabilities: CVE-2026-105133 and CVE-2026-105134. These vulnerabilities were combined to bypass authentication and execute malicious code, potentially giving attackers control of vulnerable backup servers without legitimate administrator credentials.

Huntress researchers observed exploitation beginning October 7, identifying unauthorized webshells, persistent access, and cryptocurrency-mining software. Although the investigation didn’t establish that attackers encrypted backups with ransomware, unauthorized control of the backup management platform creates a serious risk to recovery operations.

Ahsay subsequently acknowledged that earlier patches had not fully addressed the vulnerabilities and issued corrective hotfixes. Organizations using AhsayCBS should verify their installed versions and investigate potential compromise, rather than assuming the earlier update resolved the problem.

Why Does This Matter for Business Continuity?

Most organizations routinely back up their servers, databases, and business applications. But successful backup reports don’t necessarily mean those systems can be restored successfully after an attack.

Consider a ransomware incident affecting an organization’s virtual servers. If the backup management platform shares administrative credentials, network access, or other security dependencies with the compromised environment, attackers may also be able to interfere with recovery.

For credit unions, this could interrupt financial transactions and member services.
Healthcare organizations could lose access to clinical applications.
Investment firms could experience critical operational disruptions.
Educational institutions could see essential admin systems become unavailable.

These consequences are what make business continuity management an organizational risk issue, not simply an IT maintenance responsibility.

What Does an Effective Backup and Disaster Recovery Strategy Require?

A resilient recovery strategy has to account for the possibility that attackers have gained substantial access to the organization’s primary environment.

Three safeguards are particularly important:

• Isolated backups: Protected copies should remain inaccessible through compromised production systems and administrative accounts. Independent access controls matter more than simply storing backups somewhere else.
• Immutable storage: Backup copies should be protected against modification or deletion during defined retention periods, even if ordinary administrative credentials are compromised.
• Tested recovery: Organizations should regularly demonstrate that they can restore actual business applications, supporting systems, and data within their required recovery windows.

Those recovery windows are defined through two important measurements: Recovery Time Objective (RTO), the maximum targeted time to restore a service, and Recovery Point Objective (RPO), the maximum acceptable amount of data loss measured in time.

Documenting those objectives is important, but testing determines whether they’re achievable.

This is why TorchLight emphasizes verified backups and tested disaster recovery as part of its Managed IT Services. Recovery readiness should be measured through demonstrated results, not assumptions about the technology protecting your data.

What If a Third-Party Provider Manages Your Backups?

Many organizations outsource backup operations without knowing exactly which software platforms, storage providers, or administrative systems their vendors depend on.

That creates an important third-party risk management (TPRM) consideration. A provider might report that backups are completing successfully, but leadership also needs to understand how those backups are protected, who can access them, and what happens if the provider’s management infrastructure is compromised.

For regulated organizations, vendor due diligence should include recovery capabilities, vulnerability management, access controls, and independent testing. Credit unions face particularly important oversight considerations, which we explore further in our guide to vendor risk management and NCUA expectations.

Outsourcing backup management can improve operational resilience, but it does not eliminate the organization’s responsibility to understand its critical technology dependencies.

What Should CEOs and Boards Be Asking?

Business continuity governance does not require executives to become technical specialists. It requires leadership to establish the organization’s risk appetite: how much downtime, data loss, and financial exposure the organization can reasonably tolerate.

A business impact analysis should identify critical operations and their recovery requirements. Management should then demonstrate whether existing safeguards can meet those expectations.

Three questions deserve particular attention:

1. Could a compromised administrator or backup platform also destroy our protected recovery copies?
2. Have we successfully tested restoration of our most critical business systems within our documented recovery objectives?
3. Do we understand our third-party recovery dependencies, remaining risks, and the investments necessary to address them?

The answers should inform the organization’s risk register, disaster recovery budget, and ongoing cybersecurity oversight.

A cybersecurity risk assessment focused on ransomware readiness can help establish whether recovery safeguards work as intended and where improvements should be prioritized.

How TorchLight Connects Business Continuity, Cybersecurity, and Executive Accountability

Recovery planning becomes difficult when backup operations, cybersecurity, compliance, and strategic technology decisions are handled independently.

Since 2007, TorchLight has helped organizations connect these responsibilities through a security-first approach to managed IT, cybersecurity, and regulatory readiness.

Our team brings together backup verification, vulnerability management, security monitoring, risk assessment, and disaster recovery planning. For organizations with internal IT departments, our co-managed services provide additional expertise and operational support without replacing the existing team.

When executive guidance is needed, TorchLight’s fractional vCISO and vCIO services help translate technical recovery concerns into documented risk decisions, budget priorities, and measurable business continuity objectives.

The advantage is having the people assessing your risks, supporting your technology, and advising leadership working within a coordinated approach, with greater accountability from planning through recovery.

Is Your Business Continuity Plan Ready for This Scenario?

CISA’s October 14 warning demonstrates why backup management infrastructure deserves the same security attention as the systems it protects.

For executives, the most important question is whether your organization can demonstrate that its recovery strategy will work when critical infrastructure becomes unavailable or untrusted.

A backup that has never been successfully restored is an assumption. Your organization’s business continuity plan should be built on evidence.