CVE-2026-105134: Ahsay AhsayCBS Command Injection via Replication Receiver Endpoint

Background

AhsayCBS is the central backup management server component of the Ahsay backup suite, used by managed service providers (MSPs) and enterprises to orchestrate, monitor, and replicate backup jobs across client environments. As the control plane for an organization’s backup infrastructure, AhsayCBS typically holds credentials and connectivity to every backed-up endpoint it manages, including client agents, storage targets, and — for MSPs — the backup data of multiple downstream customers. A compromise of AhsayCBS therefore carries multi-tenant blast radius: a single exploited server can expose or disrupt the backup data of many unrelated organizations at once.

Backup management servers are also attractive targets because they are frequently exposed to the internet (or to a broad partner network) to allow remote client agents to check in and replicate data, and because they are often treated as “set and forget” infrastructure that receives less security attention than primary production systems.

Technical Mechanism

CVE-2026-105134 is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command, “Command Injection”) and the more specific CWE-78 (Improper Neutralization of Special Elements used in an OS Command). According to the CISA KEV entry, the flaw resides in AhsayCBS’s Replication Receiver component, specifically the /rps/api/json/UpdateReceivers.do endpoint.

The underlying pattern typical of this CWE class is that a web-exposed endpoint accepts a parameter — here, a parameter named random — and passes it, unsanitized or insufficiently sanitized, into a call that is ultimately executed by the underlying operating system shell (for example, building a shell command string or invoking a system utility with attacker-influenced arguments). Because the Replication Receiver functionality is designed to let one AhsayCBS instance communicate with another for backup replication, the endpoint is reachable by design over the network path used for replication traffic. An attacker who can reach this endpoint and manipulate the random parameter with shell metacharacters or command sequences (such as ;, |, backticks, or $()) can cause the server process to execute attacker-chosen commands with the privileges of the AhsayCBS service account.

Notably, CISA’s advisory flags that this vulnerability can be chained with CVE-2026-105133, a related Ahsay flaw. Vulnerability chaining is common in backup/management software: an initial lower-privilege issue (such as an information disclosure or authentication weakness in CVE-2026-105133) can be combined with this command injection to reach full remote code execution even where additional access controls exist. Exact chaining mechanics are not detailed in the available KEV data, and administrators should treat both CVEs as needing remediation together rather than independently.

Real-World Exploitation Evidence

CVE-2026-105134 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14. Inclusion in the KEV catalog is itself confirmation that CISA has evidence of active exploitation in the wild — it is not a theoretical or proof-of-concept-only listing.

CISA’s data for this entry lists knownRansomwareCampaignUse as “Unknown.” This means CISA has not confirmed use of this vulnerability in ransomware campaigns at this time — it does not rule out such use, but no such attribution is currently documented. Likewise, no specific threat actor or named campaign has been publicly attributed to exploitation of this CVE in the data available at the time of writing. Organizations should treat the absence of named-actor attribution as a gap in public reporting, not as evidence that exploitation is less serious; the maximum CVSS score and KEV listing alone warrant urgent action.

Impact Assessment

A CVSS score of 10.0 — the maximum possible — reflects that this vulnerability is network-exploitable, requires no authentication or user interaction, and results in complete compromise of confidentiality, integrity, and availability on the affected system. Successful command injection on an AhsayCBS server gives an attacker:

• Full remote code execution with the privileges of the AhsayCBS service process, typically allowing arbitrary file read/write, process execution, and persistence.
• Access to backup data across all managed clients. For MSPs, this can mean exposure of multiple downstream customers’ backed-up files, credentials embedded in backup configurations, and replication targets.
• A pivot point into client environments. Because AhsayCBS maintains trusted connections to backup agents on client systems, a compromised server can be used to push malicious updates or commands to those agents.
• Disruption of backup integrity. An attacker with write access to the backup management plane can delete, corrupt, or tamper with backups — a scenario frequently exploited to precede or support ransomware deployment, since destroying backups removes an organization’s recovery option.

Given the MSP/multi-tenant nature of backup management infrastructure, this is a sector-agnostic but infrastructure-critical risk: any organization using AhsayCBS, directly or through an MSP, inherits exposure.

Affected Versions

The provided KEV data does not include a specific affected version range. Organizations should consult Ahsay’s official advisory for the definitive list of affected AhsayCBS versions and the patched release.

Consult the vendor patch announcement linked in References for exact version boundaries.

Remediation Steps

CISA’s required action for this entry is to apply mitigations per vendor instructions, in compliance with CISA Binding Operational Directive (BOD) 26-04 (“Prioritizing Security Updates Based on Risk”) and the associated Forensics Triage Requirements, or to discontinue use of the product if mitigations are unavailable.

1. Apply the vendor patch immediately. Ahsay published a patch announcement covering CVE-2026-105133 and CVE-2026-105134 together — update to the fixed AhsayCBS release referenced there.

   # Example — verify current version before and after patching
   # (exact upgrade procedure is vendor/package-manager specific)
   /opt/ahsay/ahsaycbs/bin/version.sh

2. Restrict network exposure of the Replication Receiver endpoint. If /rps/api/json/UpdateReceivers.do does not need to be reachable from the broader internet, place it behind a firewall rule, VPN, or allow-list limited to known replication peers only.
3. Treat CVE-2026-105133 as a joint remediation item. Apply the companion patch for the chainable vulnerability in the same maintenance window.
4. Follow CISA BOD 26-04 forensics triage guidance before and after patching if there is any indication the system has already been exposed, to preserve evidence of potential prior compromise.
5. Evaluate internet exposure of all AhsayCBS instances across your environment (and, for MSPs, across managed client deployments) and prioritize patching of externally reachable systems first.
6. If mitigation is not immediately possible, CISA’s guidance is to discontinue use of the product until it is remediated.

Detection Guidance

Exact IDS/WAF signatures for this specific flaw are not publicly available at the time of writing; the following general guidance should be adapted using vendor or threat-intelligence-feed signatures once published:

• Web/application logs: Review AhsayCBS access logs for POST requests to /rps/api/json/UpdateReceivers.do with unusual or anomalously long/encoded values in the random parameter, particularly those containing shell metacharacters (;, |, `, $(, &&).
• Process monitoring: Alert on the AhsayCBS service process spawning unexpected child processes (shells, interpreters, network utilities such as curl/wget/nc) — this is a strong indicator of successful command injection regardless of the entry vector.
• Outbound network anomalies: Watch for outbound connections from the AhsayCBS host to unfamiliar destinations, which could indicate a reverse shell or data exfiltration following exploitation.
• File integrity monitoring: Monitor configuration and binary directories under the AhsayCBS install path for unexpected modifications.

Organizations should also consult Ahsay’s advisory and any subsequent threat-intelligence reporting for specific indicators of compromise as they emerge.

Timeline

References

• Ahsay Security Patch Announcement — CVE-2026-105133 / CVE-2026-105134
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 — Forensics Triage Requirements Implementation Guidance
• NVD — CVE-2026-105134