CVE-2026-105134: Ahsay AhsayCBS Command Injection (KEV)

CVE-2026-105134 is an OS command injection in the Replication Receiver component of Ahsay AhsayCBS backup server software: a remote, unauthenticated attacker can manipulate the 'random' parameter of the /rps/api/json/UpdateReceivers.do endpoint to execute arbitrary operating system commands, and CISA added it to the Known Exploited Vulnerabilities catalog days after disclosure, noting it can be chained with the related CVE-2026-105133.

CVE-2026-105134 is an OS command injection vulnerability (CWE-77, CWE-78) in the Replication Receiver component of Ahsay AhsayCBS. NVD's description states that "executing a manipulation of the argument random can lead to os command injection" in the file `/rps/api/json/UpdateReceivers.do", that "it is possible to launch the attack remotely," and that "the exploit has been published and may be used" (NVD).

NVD lists the CVE as "Analyzed" and records the CNA-submitted CVSS v3.1 base score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, with complete impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a required-action due date of 2026-10-17, and its catalog notes state the flaw "can be chained with CVE-2026-105133" for greater impact; known ransomware campaign use is recorded as "Unknown" (CISA KEV).

NVD's affected-version data shows AhsayCBS 10.3.0, 10.3.1 and 10.3.2 as affected and 10.3.4 as the first unaffected build; Ahsay's own release notes for v10.3.4 confirm the fix and list it as the current recommended upgrade (Ahsay Release Notes v10.3.4).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0478 (91.9th percentile), consistent with a command-injection flaw in internet-facing backup infrastructure that already has a published exploit (FIRST EPSS).

Because the vulnerability is remotely exploitable without authentication and is already listed in KEV, any AhsayCBS Replication Receiver reachable from an untrusted network should be upgraded to 10.3.4 or later immediately, with forensic triage performed per CISA's BOD 26-04 guidance for internet-exposed assets.

• Unauthenticated, remote OS command injection via the 'random' parameter of /rps/api/json/UpdateReceivers.do in the Replication Receiver component of Ahsay AhsayCBS; a public exploit exists. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per the CNA submission as recorded by NVD (status: Analyzed). — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14, due date 2026-10-17, can be chained with CVE-2026-105133. — CISA KEV
• Affects AhsayCBS 10.3.0-10.3.2; fixed in 10.3.4. — Ahsay Release Notes v10.3.4
• EPSS score is 0.0478 (91.9th percentile) as of 2026-10-21. — FIRST EPSS