Ahsay AhsayCBS Command Injection Vulnerability

Summary: A command injection vulnerability (CVE-2026-105134) has been discovered in Ahsay AhsayCBS, allowing remote attackers to execute operating system commands via an endpoint in the Replication Receiver component. This vulnerability is actively being exploited in the wild.

This news announces a command injection vulnerability (CVE-2026-105134) discovered in the Ahsay AhsayCBS backup solution, which is listed in the CISA KEV catalog. The vulnerability allows a remote attacker to execute operating system commands by manipulating the random parameter in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. This carries the potential for complete system compromise.

Command injection is a security flaw that occurs when an application directly incorporates user-supplied data into an operating system command. An attacker can append their own commands alongside the application’s intended command by using special characters or command delimiters. In this case, the random parameter might be an input used by the application to construct a backend command, and if not properly sanitized, it becomes exploitable.

For live systems and infrastructure, the impact of this vulnerability can be very severe. Backup solutions like AhsayCBS typically play a critical role as they hold backups of all systems and data. Compromising this system could lead to the entire backup infrastructure being jeopardized, data breaches, ransomware attacks, or permanent system corruption. The fact that this vulnerability can be chained with CVE-2026-105133 could further amplify the attack’s impact.

Engineers using Ahsay AhsayCBS must immediately apply any patches released for this vulnerability. Furthermore, isolating backup servers with network segmentation, implementing strong access controls, and conducting regular security audits are crucial to mitigate such risks.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar