Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Ahsay CBS lets remote attacker run commands

CVE-2026-105134 · published 15 days ago · actively exploited
Summary

The Ahsay Cloud Backup Suite contains a flaw in its Replication Receiver feature that lets a remote attacker send specially crafted data and cause the system to run arbitrary operating system commands. This could let the attacker take control of the backup server or access sensitive data. Apply the vendor's latest security update or patch and limit network access to the affected endpoint.

What to do
  • Update ahsay cloud_backup_suite to version 10.3.4 or later.
Affected software
VendorProductAffected versions
ahsay ahsaycbs 10.3.0
ahsay cloud_backup_suite < 10.3.4
cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
Original advisory text
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 3 days
and check for signs of compromise
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
5% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published4 Oct 2026
Updated16 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105134 · NVD
CVE-2026-105134 · CISA KEV
CVE-2026-105134 · MITRE
Track software like this
Free during beta