{"id":"CVE-2026-105134","kind":"vulnerability","aliases":["CVE-2026-105134"],"related":[],"title":"ahsay cloud backup suite: A flaw has been found in Ahsay AhsayCBS up to 10.3.2","description":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"AhsayCBS (self-hosted backup server) has an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (random parameter). It is chained with auth bypass CVE-2026-105133 for unauthenticated RCE (SYSTEM on Windows). Exploited since 2026-10-07 (Huntress): JSP webshells, XMRig miner, a MicrosoftEdgeUpdateSvc service for persistence. CISA KEV added it 2026-10-14. Ahsay's first patches (10.3.4.0, 9.15.2.59) did not fully fix it. Hotfixes are partner-portal only.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-10-14T00:00:00+00:00","products":[{"name":"Ahsay AhsayCBS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Ahsay AhsayCBS v10","fixed":["10.3.4.45"],"affected":"<= 10.3.4.0 (below hotfix 10.3.4.45)","ecosystem":"vendor"},{"name":"Ahsay AhsayCBS v7-v9","fixed":["9.15.2.70"],"affected":"v7, v8, v9 below hotfix 9.15.2.70 (including 9.15.2.59)","ecosystem":"vendor"},{"name":"ahsay cloud backup suite","fixed":["10.3.4"],"affected":"< 10.3.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ahsaycbs","backup-servers","exploited","rce","self-hosted","vendor","webshell"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the exact AhsayCBS build in the admin console. Exposed if v10 is below hotfix 10.3.4.45 (including 10.3.4.0), or v7/v8/v9 is below hotfix 9.15.2.70 (including 9.15.2.59). Treat the server as compromised if you find any of: unexpected root-of-drive folders (ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt); random-named .jsp files or short random folders in %CBS%\\webapps; unauthorized RPS receivers; unauthorized admin users; a MicrosoftEdgeUpdateSvc service; child processes of cbssvcX64.exe.","fix":"Apply hotfix v10.3.4.45 (v10) or v9.15.2.70 (v7-v9; v7/v8 must first upgrade to 9.15.0.0), then reboot. Both hotfixes are partner-portal only. Until patched, restrict the management interface to trusted IPs or a VPN. If compromised, Ahsay recommends a full rebuild: reinstall the OS, install 9.15.0.0 or 10.3.4.0 plus the matching hotfix, and restore config from an Auto Save that predates the compromise.","status":"resolved","published_at":"2026-10-04T07:16:33+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:49:59+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T19:49:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's mitigation or patch for AhsayCBS per CISA BOD 26-04 guidance; if no mitigation is available, discontinue use of the product. Specific fixed versions are unknown from the sources.","summary":"Ahsay AhsayCBS, a self-hosted backup server, has a command injection flaw in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint via the random parameter. A remote attacker can run operating system commands on the server, and CISA reports active exploitation; it can be chained with CVE-2026-105133.","category":"vendor","who_cares":["ahsaycbs","backup-servers","self-hosted"],"confidence":0.75,"analyst_note":"Find the vendor advisory and fixed version for AhsayCBS and check whether the Replication Receiver endpoint can be disabled; the CISA KEV entry at cisa.gov does not give affected or fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000417,"input_tokens":2279,"output_tokens":379,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and fixed version for AhsayCBS and check whether the Replication Receiver endpoint can be disabled; the CISA KEV entry at cisa.gov does not give affected or fixed versions.","search":"'-04':177C,203C,234C '-07':85B '-10':84B,101B '-105133':74B,159C '-105134':18A,21A '-14':102B '-2026':17A,20A,73B,158C '/rps/api/json/updatereceivers.do':63B,149C '10.3.2':15A '10.3.4.0':107B '2026':83B,100B '26':176C,202C,233C '9.15.2.59':108B 'accord':166C 'action':162C 'add':98B 'adher':230C 'ahsay':1A,11A,22A,24A,27A,32A,103B,119C 'ahsaycb':12A,36B,47B,120C 'ahsaycbs':23A,25A,28A 'allow':128C 'appli':163C 'applic':200C 'asset':224C 'attack':131C 'auth':70B 'backup':3A,34A,38B,51B 'backup-serv':37B 'base':181C 'bod':175C,201C,232C 'bypass':71B 'chain':68B,155C 'cisa':96B,160C,173C,190C 'cloud':2A,33A,206C 'command':56B,123C,136C 'complianc':171C 'compon':147C 'contain':121C 'could':127C 'cve':16A,19A,72B,157C 'discontinu':209C 'endpoint':62B,150C 'ensur':170C,229C 'evalu':222C 'execut':133C 'exploit':40B,81B 'exposur':227C 'first':105B 'fix':112B 'flaw':6A 'follow':199C 'forens':192C 'found':9A 'fulli':111B 'guidanc':188C,204C 'guidelin':236C 'host':44B,50B 'hotfix':114B 'huntress':86B 'inject':57B,124C 'instruct':169C 'internet':226C 'jsp':87B 'kev':97B 'manipul':138C 'microsoftedgeupdatesvc':92B 'miner':90B 'mitig':164C,215C 'note':187C,198C 'oper':134C 'os':55B 'paramet':65B,142C 'partner':117B 'partner-port':116B 'patch':106B,235C 'persist':95B 'portal':118B 'priorit':178C 'product':213C 'random':64B,141C 'rce':41B,77B 'receiv':61B,146C 'remot':130C 'replic':60B,145C 'requir':161C,194C 'respons':220C 'risk':183C 'secur':179C 'see':184C,195C 'self':43B,49B 'self-host':42B,48B 'server':39B,52B 'servic':93B,207C 'sinc':82B 'stakehold':218C 'suit':4A 'suite':35A 'system':78B,135C 'triag':193C 'unauthent':76B 'unavail':217C 'updat':180C 'url':185C,196C 'use':210C 'v10':26A 'v7':30A 'v7-v9':29A 'v9':31A 'vendor':45B,168C 'via':137C 'vulner':125C,152C 'webshel':46B,88B 'window':80B 'xmrig':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-04T07:16:33+00:00","kev":{"dateAdded":"2026-10-14","dueDate":"2026-10-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-105134","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105134","severity":null,"published_at":"2026-10-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T15:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105134:8","url":null,"severity":null,"published_at":"2026-10-23T20:18:46+00:00","modified_at":"2026-10-23T20:18:48+00:00","first_seen_at":"2026-10-23T20:18:46+00:00","fetched_at":"2026-10-23T20:18:48+00:00","note":"Added v7-v9 product entry (hotfix 9.15.2.70 per Ahsay 12 Oct notice)."},{"source":"nvd","external_id":"CVE-2026-105134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105134","severity":null,"published_at":"2026-10-04T07:16:33+00:00","modified_at":"2026-10-15T13:47:12+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":15,"url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","title":"Ahsay: Critical Security Alert update CVE-2026-105133/105134","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14,"url":"https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update","title":"Ahsay: AhsayCBS Vulnerability Status Update","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":17,"url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","title":"Huntress: Threat Actors Exploit Critical AhsayCBS Flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":470,"url":"https://www.rescana.com/post/ahsaycbs-cve-2026-105133-105134-exploited-backup-console-rce","title":"Rescana: AhsayCBS CVE-2026-105133/105134 analysis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":16,"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/","title":"Horizon3: CVE-2026-105133 & CVE-2026-105134 AhsayCBS","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}