KEV Oct 2026: AhsayCBS, SiteGuard, Siemens Software Center

What happened

CISA added these four CVEs to its Known Exploited Vulnerabilities catalog in October 2026 (CISA KEV; CISA alert, 20 October). The products are unrelated. Each section below stands alone.

AhsayCBS (CVE-2026-105133, CVE-2026-105134)

AhsayCBS is the server side of Ahsay’s backup software. Two bugs chain into unauthenticated code execution:

CVE-2026-105133: improper authentication in checkSysPwd (com/ahsay/obs/api/ApiStructsAction.java), via the random argument.
CVE-2026-105134: OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do, also via random. CVSS 10.

Both records were published on 4 October 2026 and say affected builds run up to 9.15.2.69 and 10.3.4.44 (CVE-2026-105133; CVE-2026-105134). On 12 October, Ahsay said its earlier patches, 9.15.2.59 and 10.3.4.0, “did not fully address” the bugs. It released partner-only hotfixes 10.3.4.45 (v10) and 9.15.2.70 (v7, v8, v9), and told partners to reboot after installing (Ahsay).

Huntress first saw exploitation at 23:20 UTC on 7 October; by 8 October five organisations had been targeted. Attackers got code execution as SYSTEM, dropped JSP web shells in the CBS web directory, and configured a malicious replication receiver. They then installed an XMRig miner named edge.exe and the vulnerable WinRing0x64.sys driver. Persistence was a fake service, MicrosoftEdgeUpdateSvc, running a renamed NSSM (msedge.exe) from the Temp folder. A script, Taskgmr.ps1, stopped the miner whenever Task Manager was open (Huntress). CISA added both CVEs on 14 October (CISA KEV).

SiteGuard Server Edition (CVE-2026-106931)

SiteGuard Server Edition is a host-based web application firewall from Japan’s EG Secure Solutions. Its statistics feature, on by default, has an OS command injection that runs commands as root or SYSTEM. It affects Ver2.20 and later, with the statistics feature enabled (JVN). The CVSS vectors are local with low privileges (v4.0 8.5) (CVE record).

The vendor says the bug “is already being exploited” (our translation). It warned support-contract customers on 29 September and published on 14 October (EG Secure Solutions). No attack details or IOCs were published. CISA added it on 20 October.

Siemens Software Center (CVE-2026-110936)

Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path (Siemens SSA-580366). Jose Oregon of Huntress Labs reported it.

Siemens says the attackers did not touch Siemens systems or update channels. They took a genuine, validly signed copy of Software Center 3.5.8.7 and shipped it with their own archive.dll beside it, inside an installer called AllMyBasic.msi. Siemens ties this to the “Romulus” multi-platform ClickFix campaign, where victims are tricked into pasting commands into the Run box or PowerShell (Siemens ProductCERT). CISA added it on 20 October.

Am I affected?

AhsayCBS. Any server below 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9) is exposed, including servers that took the first patches. Hunt on Windows CBS servers for the Huntress indicators (Huntress):

powershell

# Fake Edge update service; real Edge uses edgeupdate and edgeupdatem
Get-CimInstance Win32_Service -Filter "Name='MicrosoftEdgeUpdateSvc'" | Select-Object Name, PathName, StartName

# Dropped tools in any profile's Temp folder
Get-ChildItem 'C:\Users\*\AppData\Local\Temp\' -Include Taskgmr.ps1, edge.exe, msedge.exe, WinRing0x64.sys -Recurse -ErrorAction SilentlyContinue

Also check for:

Child processes of cbssvcX64.exe or cbssvcX86.exe other than normal service commands.
JSP files in the CBS web application directory that you did not deploy, and replication receivers you did not configure.
Traffic to imagefiles-backup.oss-ap-southeast-7.aliyuncs.com, to xmr.kryptex.network or 51.195.127.124 on port 8029, or from 177.4.12.11, 38.60.252.110, 107.191.47.199, 185.220.236.49, 104.234.26.10 or 123.202.208.37.
SHA-256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d (edge.exe), 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 (msedge.exe), 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 (Taskgmr.ps1).

SiteGuard Server Edition (EG Secure Solutions; JVN):

Edition	Affected	Fixed
Apache httpd, Nginx	Ver2.20 to before Ver8.00 Update 5	Ver8.00 Update 5
IIS	Ver2.20 to before Ver8.00 Update 5, except Ver3.10 to Ver4.00 Update 4	Ver8.00 Update 5
Apache httpd, Nginx on FreeBSD	Ver2.20 to before Ver7.00 Update 6	Ver7.00 Update 6

Only installs with the statistics feature enabled are affected, and it is on by default.

Siemens Software Center. Any copy below V4.0.9.8 is vulnerable. The bigger risk is a copy you never installed. Siemens’ warning signs (Siemens ProductCERT):

SiemensSoftwareCenter.exe running from AppData\Local\Programs, started by msiexec.
A folder SM Software Provisioning Service under AppData\Local\Programs.
activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
A folder FTSuite under AppData\Local containing ftc.uml.
“Siemens Software Center” in startup apps or scheduled tasks on a PC that never had it.
Connections to 96.62.218.59 or wizardexpensive.com, or downloads from 2.27.248.127.
SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a (AllMyBasic.msi) or 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 (archive.dll).

powershell

Get-ChildItem 'C:\Users\*\AppData\Local\Programs\SM Software Provisioning Service', 'C:\Users\*\AppData\Local\FTSuite\ftc.uml' -ErrorAction SilentlyContinue

Siemens says to detect on folder and behaviour, not on the Siemens file hash, because the executable is genuine.

What to do now

AhsayCBS: install hotfix 10.3.4.45 or 9.15.2.70 from the Ahsay Partner Portal, then reboot (Ahsay). Huntress confirmed 10.3.4.45 blocks the entry point. Limit the CBS management interface to trusted IPs or a VPN (Huntress).
AhsayCBS: reimage if you find any indicator. Huntress says attackers may have left secondary backdoors. A backup server also holds customer data and replication settings, so review configured replication receivers after the rebuild.
SiteGuard: save evidence before you patch. The vendor warns the update can erase attack traces. Download diagnostic data first from the web admin console (Diagnostic information, then Download diagnostic information) (EG Secure Solutions).
SiteGuard: upgrade to Ver8.00 Update 5 (FreeBSD: Ver7.00 Update 6). If you cannot, the vendor offers a patch that replaces the statistics-processing files, including for end-of-support versions (JVN).
Siemens Software Center: confirm V4.0.9.8 or later. Installs update automatically at next start (Siemens SSA-580366). Block 96.62.218.59, wizardexpensive.com and 2.27.248.127 and search logs for all three.
Siemens Software Center: if a PC shows the warning signs, Siemens says to isolate it, stop the process, remove the startup entry and scheduled task, reset passwords and follow your incident process (Siemens ProductCERT).

October 2026 KEV additions: AhsayCBS backup server RCE, SiteGuard Server Edition command injection and Siemens Software Center DLL sideloading