The first patch did not fix it, the vendor said so, and the working one was behind a partner portal

A correction first, because it is also the story.

On 12 October we wrote that two exploited AhsayCBS flaws had no patch, and that every version through 10.3.4 was affected. The second half was right. The first half was already wrong by two days: a hotfix shipped on 10 October.

It was not visible from the public research we were reading, and it is distributed through Ahsay's partner portal. So the fix existed while the public record said it did not.

What actually happened

The sequence, assembled from Ahsay's guidance as reported, Huntress's research and Horizon3's write-up:

• 4 October — the CVE records are published.
• 7 October — Huntress sees exploitation begin, at 23:20 UTC.
• 8 October — Huntress establishes that 10.3.4 is still vulnerable, correcting earlier reporting that had called it fixed.
• 10 October — Ahsay confirms that 10.3.4.0 did not adequately address either flaw, and that the v9 build 9.15.2.59 was also insufficient. It releases hotfix 10.3.4.45, and 9.15.2.70 for the v9 line.
• 14 October — CISA adds both identifiers to the exploited catalogue, due 17 October.

The current fixed builds are v10.3.4.45 and v9.15.2.70. Anyone on v7 or v8 upgrades to 9.15.0.0 first, then applies the v9 hotfix.

Huntress independently verified that 10.3.4.45 blocks the authentication bypass, which is the entry to the chain — close that and the command execution behind it is unreachable. Rescana notes it found no independent confirmation that the hotfix fully resolves both issues, and advises treating any v10 build below 10.3.4.45 as potentially exposed.

A vendor saying its own patch failed is rare and useful

It is worth pausing on the 10 October admission, because most vendors do not make it.

The normal failure mode, when a shipped patch turns out to be insufficient, is silence: a second build appears with a vague changelog, nobody is told the first one was incomplete, and administrators who patched believe they are done. A remote-access vendor did that in June, shipping a fix for pre-authentication root in a release whose notes described it only as a crash; the gap between fixing and telling ran to four months.

Ahsay did the opposite: it named the insufficient builds. That is the behaviour that lets an administrator know they are not finished, and it is the reason this story is a correction rather than a quiet re-exploitation in three weeks.

The distribution is the part that still does not work. A fix behind a partner portal is a fix that security researchers, CERTs and the press cannot see, which is how public reporting — ours included — ends up two days out of date on the most important question in the story.

Patching does not clean up

The other line worth carrying from Ahsay's guidance: applying the hotfix does not remove webshells, unauthorised accounts, or other persistence left by an intrusion that already happened.

Ahsay's own recommendation for a compromised host is to reinstall the operating system, install AhsayCBS with the hotfix, and restore a server configuration that predates the compromise.

That is the strongest version of a point this site keeps making, and it is the vendor making it. On a backup platform used by managed service providers it is also the hardest advice to follow, because the machine being rebuilt is the one that holds everyone else's restore points.

The catalogue lag, measured

One number falls out of this timeline that is worth keeping.

Exploitation was observed on 7 October. The identifiers entered CISA's exploited catalogue on 14 October. Seven days, and ten from the CVE records being published.

We made the general point in that first piece that absence from the catalogue is not evidence of absence. This is the specific measurement on a case we watched from the start.

What to do

• If you run AhsayCBS, go to v10.3.4.45 or v9.15.2.70. If you applied 10.3.4.0 or 9.15.2.59 and stopped, you are not patched.
• The hotfix is on the partner portal. If you reach Ahsay through an MSP, that is who has to apply it.
• Patching is not remediation here. Check for the indicators Huntress published before deciding the host is clean.
• Keep the management interface off the internet regardless of version.

What is not established

• Whether the hotfix fully resolves both flaws. Huntress verified the bypass is blocked; nobody has independently confirmed more than that.
• Why the first builds were insufficient.
• How many organisations were compromised in the window between 7 and 10 October.
• Whether a fix was available to partners earlier than 10 October.
• Whether Ahsay will publish advisories outside the partner portal in future.