Ahsay AhsayCBS: OS command injection in Replication Receiver
Deadline for US federal agencies: 17 Oct 2026
Summary
AhsayCBS, the central management server for Ahsay backup software, contains an OS command injection flaw in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. An attacker can manipulate the random argument to run operating system commands remotely, and the flaw is chained with CVE-2026-105133, an authentication bypass. Exploitation is active in the wild, with attackers deploying webshells and XMRig cryptominers, and CISA lists it in the Known Exploited Vulnerabilities catalog.
Affected
- AhsayCBS up to 9.15.2.69 and 10.3.4.44 according to the CVE description
- Ahsay's own sources and secondary reports state that 10.3.4 is also affected, so treat all builds below the fixed versions as affected
- AhsayCBS v7 and v8 are also affected according to Ahsay's advisory
- Affected range is partly conflicting across sources
Fixed in
- AhsayCBS v10: hotfix 10.3.4.45
- AhsayCBS v9 (and v7/v8, after upgrading to v9): hotfix 9.15.2.70
- Earlier patches 9.15.2.59 and 10.3.4.0 did not fully fix the flaw
- The hotfixes require a valid Ahsay partner portal account
- Reboot the server after applying the hotfix
Workaround
- Unknown. Ahsay's advisory lists no workaround.
- Restrict access to the AhsayCBS web console and the Replication Receiver endpoint to VPN or trusted IP addresses. This is the main mitigation until patching is complete.
Exploitation
- Known exploited: CISA added the vulnerability to its KEV catalog.
- Exploitation observed since October 7, 2026, with remote code execution on impacted hosts.
- Chained with CVE-2026-105133 (authentication bypass), which is used first.
- Attackers deploy webshells and XMRig cryptominers.
- A public exploit is reported in the CVE description; no public code was verified.
- No authentication is assumed to be required.
Our recommendation
- Inventory all AhsayCBS instances (v7 to v10) and check whether any are reachable from the internet.
- Immediately restrict the web console and replication endpoints to VPN or trusted IPs.
- Update to v10.3.4.45 or v9.15.2.70; upgrade v7 and v8 to v9 first. Reboot the server afterwards.
- Check for compromise: unexpected JSP files under %CBS%\webapps, unknown replication receivers, unknown AhsayCBS administrator accounts, and unusual child processes of cbssvcX64.exe.
- If indicators are found, reinstall the operating system, install the fixed AhsayCBS version and restore a configuration created before the compromise.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
RayanAlmulhim/CVE-2026-105134-lab
Research sources
- CVE record (VulDB) vuldb.com
- Ahsay announcement (update on CVE-2026-105133 and CVE-2026-105134) www.ahsay.com
- Ahsay vulnerability status update www.ahsay.com
- Huntress: AhsayCBS flaws exploited www.huntress.com
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov
- Horizon3.ai: CVE-2026-105133 and CVE-2026-105134 horizon3.ai
- Bitdefender technical advisory: AhsayCBS exploitation chain www.bitdefender.com
- GitHub Security Advisory GHSA-mxj3-2x8q-2rh9 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:21.
Original description (NVD)
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (7)
- https://vuldb.com/cve/CVE-2026-105134
- https://vuldb.com/submit/942743
- https://vuldb.com/vuln/413351
- https://vuldb.com/vuln/413351/cti
- https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.