cyfenced.com →

[ CVE-2026-105134 · Published 4 Oct 2026 ]

Command injection in AhsayCBS backup server

Exploited · CISA KEV CVSS 10.0 EPSS 38%1 agency advisoryNo fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-14
  • EPSS: 38% chance of exploitation in the next 30 days (higher than 99% of CVEs)
  • Critical severity: CVSS 10.0

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, a public exploit exists and no credentials are needed.

Red alert if
You run an AhsayCBS server on version 10.3.2 or earlier that is reachable from the internet.
Can wait if
You do not run AhsayCBS, or you are already on 10.3.4 or later.
What it is
An OS command injection flaw in the Replication Receiver of the AhsayCBS backup server lets a remote attacker run commands without logging in. Versions up to 10.3.2 are affected and version 10.3.4 fixes it; a public exploit exists.
Impact
Anyone who can reach the backup server can run commands on it and take full control. Backup servers hold copies of company data and are a favourite target before ransomware is deployed, because deleting or encrypting backups makes recovery much harder.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends a crafted request to the Replication Receiver API.
  2. T1059 Command and Scripting InterpreterThe injected input runs operating system commands on the backup server.
  3. T1005 Data from Local SystemThey read backed-up company data stored on the server.
  4. T1485 Data DestructionBackups can be deleted to block recovery from a later attack.

What to do

  1. Upgrade AhsayCBS to 10.3.4 or later, as described in Ahsay's patch announcement.
  2. Block internet access to the Replication Receiver unless you use replication from outside your network.
  3. Check the server for unknown processes, accounts and changes to backup jobs or retention settings.
  4. Make sure you have an offline or immutable copy of your backups.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

CISA: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References