CVE-2026-105134
Ahsay AhsayCBS Command Injection Vulnerability - [Actively Exploited]
Description
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
INFO
Published Date :
Oct. 4, 2026, 7:16 a.m.
Last Modified :
Oct. 15, 2026, 1:47 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Unknown
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134
Affected Products
The following products are affected by CVE-2026-105134
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 2.0 | HIGH | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Upgrade Ahsay AhsayCBS to version 10.3.4.
- Apply updates to the Replication Receiver component.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-105134.
| URL | Resource |
|---|---|
| https://vuldb.com/cve/CVE-2026-105134 | Third Party Advisory VDB Entry |
| https://vuldb.com/submit/942743 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/413351 | Permissions Required VDB Entry |
| https://vuldb.com/vuln/413351/cti | Permissions Required VDB Entry |
| https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 | Release Notes |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 | US Government Resource |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-105134 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-105134
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-105134 vulnerability anywhere in the article.
-
The Hacker News
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vuln ... Read more
-
security.nl
Ahsay komt met update voor actief misbruikt lek in Cloud Backup Server
Softwareontwikkelaar Ashay heeft een hotfix uitgebracht voor een kwetsbaarheid waar aanvallers al zeker sinds 4 oktober misbruik van maken. Bij de aanvallen zijn meerdere organisaties gehackt. Ahsay C ... Read more
-
The Hacker News
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone d ... Read more
-
The Hacker News
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Deta ... Read more
-
security.nl
Organisaties gehackt via kritiek lek in Ahsay Cloud Backup Server
Aanvallers maken actief misbruik van twee kwetsbaarheden in Ahsay Cloud Backup Server (CBS) voor het hacken van organisaties en beveiligingsupdates zijn nog niet beschikbaar. Dat meldt cybersecuritybe ... Read more
-
Huntress
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Acknowledgements: Special thanks to Dipo Rodipe, John Hammond, Susannah Matt, Ben Nahorney, and Lindsey Welch for their contributions to this investigation and writeup. Update 10/8/26 @ 6pm ETAfter fu ... Read more
The following table lists the changes that have been made to the
CVE-2026-105134 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 15, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:* versions up to (excluding) 10.3.4 Added Reference Type VulDB: https://vuldb.com/cve/CVE-2026-105134 Types: Third Party Advisory, VDB Entry Added Reference Type VulDB: https://vuldb.com/submit/942743 Types: Third Party Advisory, VDB Entry Added Reference Type VulDB: https://vuldb.com/vuln/413351 Types: Permissions Required, VDB Entry Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/cve/CVE-2026-105134 Types: Permissions Required, Third Party Advisory nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/cve/CVE-2026-105134 Types: Permissions Required, Third Party Advisory, Third Party Advisory, VDB Entry Added Reference Type VulDB: https://vuldb.com/vuln/413351/cti Types: Permissions Required, VDB Entry Added Reference Type VulDB: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 Types: Release Notes Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 Types: US Government Resource Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/submit/942743 Types: Permissions Required, Third Party Advisory nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/submit/942743 Types: Permissions Required, Third Party Advisory, Third Party Advisory, VDB Entry Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/vuln/413351 Types: Permissions Required, Third Party Advisory nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/vuln/413351 Types: Permissions Required, Permissions Required, Third Party Advisory, VDB Entry Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/vuln/413351/cti Types: Permissions Required, Third Party Advisory nvd-ai-agent-0.4.0-gemma-4-31B-it: https://vuldb.com/vuln/413351/cti Types: Permissions Required, Permissions Required, Third Party Advisory, VDB Entry -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 15, 2026
Action Type Old Value New Value Removed SSVC {'id': 'CVE-2026-105134', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-14T19:32:43.962562Z'} Added SSVC {'id': 'CVE-2026-105134', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-14T00:00:00+00:00'} -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Oct. 14, 2026
Action Type Old Value New Value Added Date Added 2026-10-14 Added Due Date 2026-10-14 Added Required Action 2026-10-14 Added Vulnerability Name 2026-10-14 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 14, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 Removed SSVC {'id': 'CVE-2026-105134', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-05T15:40:33.388359Z'} Added SSVC {'id': 'CVE-2026-105134', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-14T19:32:43.962562Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 05, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-105134', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-05T15:40:33.388359Z'} -
New CVE Received by [email protected]
Oct. 04, 2026
Action Type Old Value New Value Added Description A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CVSS V2 (AV:N/AC:L/Au:N/C:C/I:C/A:C) Added CWE CWE-78 Added CWE CWE-77 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/105xxx/CVE-2026-105134.json">CVE-2026-105134</a> Added Reference https://vuldb.com/cve/CVE-2026-105134 Added Reference https://vuldb.com/submit/942743 Added Reference https://vuldb.com/vuln/413351 Added Reference https://vuldb.com/vuln/413351/cti Added Reference https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4