CVE-2026-105134 Ahsay AhsayCBS Command Injection
Remote attackers can execute arbitrary OS commands via the random argument in the Replication Receiver API, requiring an upgrade to mitigate.
- Exploited in the wild
- Since 14 Oct 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105134?
CVE-2026-105134 is a critical command injection vulnerability in AhsayCBS, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Which versions are affected by CVE-2026-105134?
It affects 1 product.
Products include Ahsay Cloud Backup Suite.
How do I fix CVE-2026-105134?
No fix has been published for CVE-2026-105134 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Oct 2026.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-105134 being exploited?
Yes. Attackers have exploited CVE-2026-105134 in the wild since at least 14 Oct 2026.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in AhsayCBS
Sources
Also known as GHSA-mxj3-2x8q-2rh9.