CVE-2026-105134

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

No known exploitation. EPSS puts it in the 78th percentile. Fixed in 10.3.4.

CVSS 3.110.0Critical EPSS percentile78th1.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix10.3.4Upgrade to this build

Published 2026-10-04Updated 2026-10-06Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

AhsayCBSAffected: 10.3.0Upgrade to: not statedAffected: 10.3.1Upgrade to: not statedAffected: 10.3.2Upgrade to: not statedFixed builds10.3.4Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your AhsayCBS version — if it is 10.3.2 or earlier, you are affected.
Confirm whether your AhsayCBS server is reachable from the internet; if so, treat this as critical and urgent.
Upgrade to AhsayCBS version 10.3.4 immediately using the official release.
After upgrading, check the server for signs of compromise — unexpected processes (especially one disguised as edge.exe), unfamiliar .jsp files, or unusual CPU usage from cryptomining.
If signs of compromise are found, isolate the server from the network and involve an incident response professional before reconnecting it.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Exploitation reported in the wild
as reported · Oct 9, 2026·BleepingComputer summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

In plain language

Written by AI from the record

Attackers are actively breaking into AhsayCBS backup servers (version 10.3.2 and earlier) without needing any password, so if you run this software, treat it as an emergency and update to 10.3.4 now.

Unauthenticated OS command injection in AhsayCBS's Replication Receiver (UpdateReceivers.do, via the 'random' parameter) is being actively exploited in the wild, chained with CVE-2026-105133, to deploy JSP webshells and XMRig cryptominers.

If you're affected

Full backup server takeover
Backup data exposure or deletion
Cryptomining malware infection
Webshell persistent backdoor
Operational disruption

What is it

AhsayCBS is backup software businesses rely on to protect their data. This flaw is like leaving a side door to that backup server wide open — no key or password needed — letting an outsider walk in and run their own commands on it. Attackers are already using this open door to install hidden backdoors and secretly mine cryptocurrency using your server's resources.

Who is affected

This matters to you if you run AhsayCBS for backup management, specifically version 10.3.2 or any earlier release. The flaw requires no login and no action from any user — if your AhsayCBS server is reachable from the internet, it is exposed right now.

How urgent is it

Attackers are already exploiting this flaw in the wild, deploying webshells and cryptomining malware on at least five organizations' servers. This is not a theoretical risk — act immediately rather than waiting for a routine maintenance window. Treat any internet-facing AhsayCBS instance as compromised until verified otherwise.

What to do — in detail

Confirm exposure by checking whether the AhsayCBS Replication Receiver endpoint (/rps/api/json/UpdateReceivers.do) is reachable from the internet and whether the installed version is ≤10.3.2. Upgrade to 10.3.4, which fixes both CVE-2026-105134 and the chained authentication bypass CVE-2026-105133 — review the official release notes (https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4) for upgrade steps and any breaking changes. If immediate patching isn't possible, restrict network access to the AhsayCBS management interface (firewall/VPN-only access) as a temporary mitigation — this is not a substitute for patching. Post-upgrade, audit the server for indicators of compromise: unexpected .jsp webshell files, processes named edge.exe or unusual CPU spikes consistent with XMRig mining, and outbound connections to unfamiliar mining pools. No CISA KEV listing exists yet, so there is no mandated federal remediation deadline, but active exploitation in the wild warrants emergency-level treatment regardless. Monitor vendor advisories for IOC lists and consider engaging incident response if any compromise indicators are found.

Technical context

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, network-exploitable OS command injection (CWE-77/CWE-78) with full confidentiality, integrity, and availability impact and a scope change. Exploitation is confirmed via news reporting (first observed 2026-10-07), with threat actors chaining this flaw with CVE-2026-105133 to bypass authentication and achieve RCE, deploying JSP webshells and XMRig cryptominers disguised as edge.exe across at least five organizations. Not yet listed in CISA KEV. No public exploit code is on record, but active in-the-wild exploitation makes this a confirmed, not predicted, threat — exploit maturity should be considered functional/weaponized despite the absence of a public PoC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS78th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.8% chance of exploitation activity in the next 30 days, which ranks it in the 78th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-10-06Record updated
2026-10-05Record updated
2026-10-04Publishedweakness classified, att&ck mapped, record updated

Affected products

Ahsaycommercialaka ah say, ahsay backup
- AhsayCBSSaaSEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable