Ahsay AhsayCBS
CVE-2026-105134: OS command injection in the AhsayCBS Replication Receiver.
A flaw in the Replication Receiver of AhsayCBS, in the UpdateReceivers.do endpoint, lets a remote attacker inject operating system commands through the random argument. With the authentication bypass in CVE-2026-105133 it needs no credentials, and CISA lists it as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 14 Oct 2026
- Federal due date 17 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 82% in 30 days
- Percentile 100%, scored 29 Oct 2026
- 10.0Critical, (CVSS 4.0)Scored by NVD
- 82%EPSS, chance of exploitation in 30 daysPercentile 100%; scored 29 Oct 2026
- 4 OctPublished by NVD4 Oct 2026; record read 26 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| AhsayCBS v7 to v10 before the October hotfixes | AhsayCBS 10.3.4.45 hotfix, 9.15.2.70 hotfix for v7 to v9 |
What to do now
Install the AhsayCBS hotfix on the backup server and reboot it; the first October patch left this flaw open. Our advisory sets out the release's steps.
How to check exposure
A server on any build up to 9.15.2.69 or 10.3.4.44 is exposed; the hotfix builds are 9.15.2.70 and 10.3.4.45, read from the system settings page. The NVD record's note that the initial patch did not fix the flaw means an early October build counts as unpatched.
The Replication Receiver endpoint is reached over the same web interface the backup clients use, so a server with that interface on the internet is exposed to any sender.
Who this reaches in Australia
The two AhsayCBS flaws together give a remote attacker commands on a backup server with no credentials, which for a managed service provider means commands on the server that holds every client's data. Australian providers that resell Ahsay backup carry the exposure for their whole client list.
On the Essential Eight this is a patch applications item on a 48 hour clock, and the server it sits on is the regular backups strategy made physical: commands on it are commands over every client's recovery.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : CISA due date for US federal agencies
- : NVD record last modified
Questions, answered.
What is the difference between CVE-2026-105133 and CVE-2026-105134?
CVE-2026-105133 bypasses authentication in the API; CVE-2026-105134 injects operating system commands in the Replication Receiver. Chained, an attacker with no credentials runs commands on the server. Both are fixed by the same hotfixes.
Which builds fix it?
The 10.3.4.45 hotfix on v10 and the 9.15.2.70 hotfix on v7 to v9, each followed by a reboot, the same builds that close the authentication bypass.
What does the CISA listing mean here?
The catalogue confirms exploitation in the wild as at 14 October 2026. For an Australian provider that is the signal that the hotfix belongs inside the 48 hour window of the Essential Eight, with a review of the server's logs before it.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-105134NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-105134EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS