Security Advisory

CVE-2026-105134: Ahsay AhsayCBS Command Injection (KEV)

Last updated:
  • CVE-2026-105134

CVE-2026-105134 is an OS command injection in the Replication Receiver component of Ahsay AhsayCBS backup server software: a remote, unauthenticated attacker can manipulate the 'random' parameter of the /rps/api/json/UpdateReceivers.do endpoint to execute arbitrary operating system commands, and CISA added it to the Known Exploited Vulnerabilities catalog days after disclosure, noting it can be chained with the related CVE-2026-105133.

Vulnerability summary

CVSS base score

10

Critical severity

EPSS score (FIRST)

4.8%

Probability of exploitation in the wild in the next 30 days

CISA KEV catalog

Yes

Listed as known exploited

Published

Vulnerability ID: CVE-2026-105134 · Source: NVD

Affected components

ComponentCPEVersion range
Ahsay AhsayCBScpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*10.3.0, 10.3.1 and 10.3.2 are confirmed affected (fixed in 10.3.4, per NVD and Ahsay release notes)

What does this mean for affected devices?

CVE-2026-105134 is an OS command injection vulnerability (CWE-77, CWE-78) in the Replication Receiver component of Ahsay AhsayCBS. NVD's description states that "executing a manipulation of the argument random can lead to os command injection" in the file `/rps/api/json/UpdateReceivers.do", that "it is possible to launch the attack remotely," and that "the exploit has been published and may be used" (NVD).

NVD lists the CVE as "Analyzed" and records the CNA-submitted CVSS v3.1 base score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, with complete impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a required-action due date of 2026-10-17, and its catalog notes state the flaw "can be chained with CVE-2026-105133" for greater impact; known ransomware campaign use is recorded as "Unknown" (CISA KEV).

NVD's affected-version data shows AhsayCBS 10.3.0, 10.3.1 and 10.3.2 as affected and 10.3.4 as the first unaffected build; Ahsay's own release notes for v10.3.4 confirm the fix and list it as the current recommended upgrade (Ahsay Release Notes v10.3.4).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0478 (91.9th percentile), consistent with a command-injection flaw in internet-facing backup infrastructure that already has a published exploit (FIRST EPSS).

Because the vulnerability is remotely exploitable without authentication and is already listed in KEV, any AhsayCBS Replication Receiver reachable from an untrusted network should be upgraded to 10.3.4 or later immediately, with forensic triage performed per CISA's BOD 26-04 guidance for internet-exposed assets.

How to fix this class of issueThis advisory's weakness class is Command injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix command injection in embedded firmware.

Evidence

  • Unauthenticated, remote OS command injection via the 'random' parameter of /rps/api/json/UpdateReceivers.do in the Replication Receiver component of Ahsay AhsayCBS; a public exploit exists. — NVD
  • CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per the CNA submission as recorded by NVD (status: Analyzed). — NVD
  • Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14, due date 2026-10-17, can be chained with CVE-2026-105133. — CISA KEV
  • Affects AhsayCBS 10.3.0-10.3.2; fixed in 10.3.4. — Ahsay Release Notes v10.3.4
  • EPSS score is 0.0478 (91.9th percentile) as of 2026-10-21. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportChat with David on WhatsApp

Related advisories

CVE-2026-10520: Ivanti Sentry OS Command Injection RCE (KEV) — CVSS 10, Critical severityCISA KEVCVE-2026-10520: KEV OS command injection lets an unauthenticated attacker reach root-level RCE on exposed, unmanaged Ivanti Sentry appliances; chainable with the companion auth-bypass CVE-2026-10523. Versions, scoring sourced to NVD, watchTowr and CISA.CVE-2026-106931: SiteGuard WAF OS Command Injection — CVSS 7.8, High severityCISA KEVCVE-2026-106931: KEV command injection in SiteGuard WAF lets attackers run root/SYSTEM commands; actively exploited. Sourced to NVD, CISA, JVN, FIRST EPSS.CVE-2026-107861: Kiloview E3 NDI Encoder Root Command Injection (pending)CVE-2026-107861: unsanitized hostname field lets an authenticated user run root OS commands on Kiloview E3 NDI encoders. NVD has not, as of 2026-10-22, completed its analysis.

Sources

  1. NVD
  2. CISA KEV
  3. Ahsay Release Notes v10.3.4
  4. FIRST EPSS

Frequently asked questions

What is CVE-2026-105134?

CVE-2026-105134 is an OS command injection in the Replication Receiver component of Ahsay AhsayCBS backup server software: a remote, unauthenticated attacker can manipulate the 'random' parameter of the /rps/api/json/UpdateReceivers.do endpoint to execute arbitrary operating system commands, and CISA added it to the Known Exploited Vulnerabilities catalog days after disclosure, noting it can be chained with the related CVE-2026-105133.

How severe is CVE-2026-105134?

NVD scores CVE-2026-105134 10 out of 10 on the CVSS scale — a critical severity rating.

Is CVE-2026-105134 being actively exploited?

Yes — CVE-2026-105134 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed evidence of active exploitation in the wild.

What is affected by CVE-2026-105134?

CVE-2026-105134 affects Ahsay AhsayCBS.

Where does this CVE-2026-105134 information come from?

This advisory is based on NVD, CISA KEV, Ahsay Release Notes v10.3.4, and FIRST EPSS, cited in full in the Sources section above.

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp