Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105134updated 26 Oct 2026, 15:17 UTC

Ahsay AhsayCBS backup server can be taken over remotely via command injection

Attackers can send a specially crafted request to the backup server and make it run their own commands on the machine. Attacks on this flaw have been confirmed.

Exploited (CISA KEV, NVD)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 10 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 14 Oct 2026
Fix available?YesVersion 9.15.2.70 and 10.3.4.45 (per NVD, which notes the initial patch was incomplete); version 10.3.4 (per GitHub advisory) · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted request from anywhere
  2. 2InternetRequest reaches exposed server
  3. 3AhsayCBS endpointUpdateReceivers.do accepts manipulated 'random' value
  4. 4OS command runsInjected input executed by the system
  5. ResultAttacker controls the backup server

What happened

A command injection flaw in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint lets a remote attacker pass manipulated input in the 'random' parameter and execute operating system commands. It can be chained with CVE-2026-105133.

Why it is dangerous: A successful attacker can run commands with the server's privileges, which can lead to full control of the system and its stored backup data. Organizations exposing AhsayCBS to the internet are at highest risk.

Are you affected?

You are affected if you run Ahsay AhsayCBS up to version 10.3.2, or up to 9.15.2.69 / 10.3.4.44 per NVD, with the Replication Receiver component reachable on your network.

Ahsay AhsayCBS up to 10.3.2 (GitHub); up to 9.15.2.69 and 10.3.4.44 (NVD)

What to do

  1. Update AhsayCBS to 10.3.4.45 or 9.15.2.70 or later, as the initial patch was incomplete
  2. If you cannot patch immediately, restrict access to the Replication Receiver endpoint or take the server off the internet
  3. Review logs for requests to /rps/api/json/UpdateReceivers.do and check for signs of compromise
  4. Follow CISA's forensics triage requirements if exposure is confirmed

Timeline

  1. 4 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 14 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to version 10.3.4 or later.
  5. 26 Oct 2026, 15:17 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105134 · GHSA-mxj3-2x8q-2rh9
CVSS
10 / 10
EPSS
82% chance of exploitation within 30 days
Disclosed
4 Oct 2026, 07:16 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 15:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ahsay AhsayCBS backup server can be taken over remotely via command injection · Zero Radar