CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
Vulnerability summary
CVE-2026-105134 is a critical (CVSS 10.0) Command Injection vulnerability in Ahsay AhsayCBS. It is known to be exploited: CISA and ENISA list it, first on 14-10-2026. EPSS estimates a 81.76% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 1 public exploit is recorded.
Listed as exploited by ENISA (23-10-2026)
Source freshness unavailable
How is this decided?Timeline
- 04-10-2026PublishedVulnerability first disclosed.
- 14-10-2026Added to CISA KEVExploitedAhsay AhsayCBS Command Injection Vulnerability
- 17-10-2026CISA remediation dueDeadline passedApply mitigations per vendor instructions.
- 23-10-2026Added to ENISA KEVExploitedAdded to the ENISA known exploited vulnerabilities catalog.
- 26-10-2026Last modifiedVulnerability information updated.
Description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST10.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- NVDNIST10.0HighAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS trend
Probability
81.76%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 14-10-2026
- Federal due date
- 17-10-2026
ENISA CNWListed- Added
- 23-10-2026
CIRCLNot in the CIRCL catalog.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update nvd.nist.gov/vuln/detail/CVE-2026-105134
Public exploits
1 foundExploit Reference (huntress.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ahsay2 products
- ahsaycbs9.15.2.0 | 9.15.2.1 | 9.15.2.2 | 9.15.2.3 | 9.15.2.4 | 9.15.2.5 | 9.15.2.6 | 9.15.2.7 | 9.15.2.8 | 9.15.2.9 | 9.15.2.10 | 9.15.2.11 | 9.15.2.12 | 9.15.2.13 | 9.15.2.14 | 9.15.2.15 | 9.15.2.16 | 9.15.2.17 | 9.15.2.18 | 9.15.2.19 | 9.15.2.20 | 9.15.2.21 | 9.15.2.22 | 9.15.2.23 | 9.15.2.24 | 9.15.2.25 | 9.15.2.26 | 9.15.2.27 | 9.15.2.28 | 9.15.2.29 | 9.15.2.30 | 9.15.2.31 | 9.15.2.32 | 9.15.2.33 | 9.15.2.34 | 9.15.2.35 | 9.15.2.36 | 9.15.2.37 | 9.15.2.38 | 9.15.2.39 | 9.15.2.40 | 9.15.2.41 | 9.15.2.42 | 9.15.2.43 | 9.15.2.44 | 9.15.2.45 | 9.15.2.46 | 9.15.2.47 | 9.15.2.48 | 9.15.2.49 | 9.15.2.50 | 9.15.2.51 | 9.15.2.52 | 9.15.2.53 | 9.15.2.54 | 9.15.2.55 | 9.15.2.56 | 9.15.2.57 | 9.15.2.58 | 9.15.2.59 | 9.15.2.60 | 9.15.2.61 | 9.15.2.62 | 9.15.2.63 | 9.15.2.64 | 9.15.2.65 | 9.15.2.66 | 9.15.2.67 | 9.15.2.68 | 9.15.2.69 | 10.3.4.0 | 10.3.4.1 | 10.3.4.2 | 10.3.4.3 | 10.3.4.4 | 10.3.4.5 | 10.3.4.6 | 10.3.4.7 | 10.3.4.8 | 10.3.4.9 | 10.3.4.10 | 10.3.4.11 | 10.3.4.12 | 10.3.4.13 | 10.3.4.14 | 10.3.4.15 | 10.3.4.16 | 10.3.4.17 | 10.3.4.18 | 10.3.4.19 | 10.3.4.20 | 10.3.4.21 | 10.3.4.22 | 10.3.4.23 | 10.3.4.24 | 10.3.4.25 | 10.3.4.26 | 10.3.4.27 | 10.3.4.28 | 10.3.4.29 | 10.3.4.30 | 10.3.4.31 | 10.3.4.32 | 10.3.4.33 | 10.3.4.34 | 10.3.4.35 | 10.3.4.36 | 10.3.4.37 | 10.3.4.38 | 10.3.4.39 | 10.3.4.40 | 10.3.4.41 | 10.3.4.42 | 10.3.4.43 | 10.3.4.44
- cloud_backup_suite< 10.3.4 | < 9.15.2.70 | ≥ 10.1.0, < 10.3.4.45
1 vendor · 2 products
References
8 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134Government ResourceUS Government Resource