CVE-2026-105134

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://vuldb.com/cve/CVE-2026-105134 Third Party Advisory VDB Entry
https://vuldb.com/submit/942743 Third Party Advisory VDB Entry
https://vuldb.com/vuln/413351 Permissions Required VDB Entry
https://vuldb.com/vuln/413351/cti Permissions Required VDB Entry
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update Vendor Advisory
https://www.huntress.com/blog/ahsaycbs-flaws-exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
History

26 Oct 2026, 18:06

Type Values Removed Values Added
References () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update - () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update - Vendor Advisory
References () https://www.huntress.com/blog/ahsaycbs-flaws-exploit - () https://www.huntress.com/blog/ahsaycbs-flaws-exploit - Third Party Advisory

26 Oct 2026, 15:16

Type Values Removed Values Added
Summary (en) A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised. (en) A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
References
  • {'url': 'https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4', 'tags': ['Release Notes'], 'source': 'cna@vuldb.com'}
  • () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update -
  • () https://www.huntress.com/blog/ahsaycbs-flaws-exploit -

15 Oct 2026, 13:47

Type Values Removed Values Added
References () https://vuldb.com/cve/CVE-2026-105134 - () https://vuldb.com/cve/CVE-2026-105134 - Third Party Advisory, VDB Entry
References () https://vuldb.com/submit/942743 - () https://vuldb.com/submit/942743 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/413351 - () https://vuldb.com/vuln/413351 - Permissions Required, VDB Entry
References () https://vuldb.com/vuln/413351/cti - () https://vuldb.com/vuln/413351/cti - Permissions Required, VDB Entry
References () https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 - () https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 - Release Notes
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 - US Government Resource
First Time Ahsay cloud Backup Suite
Ahsay
CPE cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*

14 Oct 2026, 20:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 -

04 Oct 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-04 07:16

Updated : 2026-10-26 18:06

NVD link : CVE-2026-105134

Mitre link : CVE-2026-105134

CVE.ORG link : CVE-2026-105134

JSON object : View

Products Affected

ahsay

  • cloud_backup_suite
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')