Ahsay AhsayCBS Command Injection Added To CISA KEV (CVE-2026-105134)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-105134: 9.3
EPSS (30-day exploit probability)	CVE-2026-105134: 1.8%
In CISA KEV (exploited)	Yes, due 2026-10-17
Vendor	Ahsay
CVE IDs	CVE-2026-105134

CISA has added an AhsayCBS command injection flaw, CVE-2026-105134, to its Known Exploited Vulnerabilities catalog on 2026-10-14, according to the CISA KEV entry. The Ahsay AhsayCBS vulnerability lets a remote attacker run operating system commands, and the federal remediation due date is 2026-10-17, only three days after listing.

NVD scores the flaw 9.3 (CVSS 4.0, critical) and notes that a public exploit has been published. If you run AhsayCBS, treat this as a patch-within-hours item.

What happened

CISA’s catalog describes the issue as a command injection vulnerability in the Replication Receiver component of AhsayCBS. By manipulating the random parameter of the /rps/api/json/UpdateReceivers.do endpoint, a remote attacker can execute operating system commands on the server.

The entry also says this flaw can be chained with CVE-2026-105133, another AhsayCBS vulnerability that CISA added to the same catalog. How the two are combined in attacks has not been disclosed in the material we have, so defenders should treat both as one exposure and check them together.

Am I affected? Is AhsayCBS affected

Per NVD, the following applies:

Affected: Ahsay AhsayCBS up to version 10.3.2.
Fixed: upgrading to version 10.3.4 resolves the issue, according to the NVD description and the Ahsay release notes it references.
Vulnerable component: Replication Receiver, endpoint /rps/api/json/UpdateReceivers.do.

NVD does not list a structured affected-product table, and the description does not say whether any release between 10.3.2 and 10.3.4 is affected. Not disclosed. Until you confirm otherwise, treat anything older than 10.3.4 as exposed.

Technical details

Weakness: CWE-77 and CWE-78 (command and OS command injection, where attacker-supplied input ends up in a command the server runs).
Attack vector: network, low complexity, no privileges and no user interaction required, per the CVSS 4.0 vector.
CVSS 4.0 base score: 9.3, critical.
Exploitation: CISA lists it as known exploited; NVD says an exploit has been published.
CISA KEV date added: 2026-10-14. Due date: 2026-10-17.
Known ransomware campaign use: Unknown.
EPSS: 0.01843, which is a low modelled probability. This sits awkwardly beside KEV listing and a public exploit, so rely on the KEV status rather than the EPSS number when prioritising.

CISA’s required action tells organisations to apply vendor mitigations, follow the applicable BOD guidance for cloud services, and discontinue use of the product if mitigations are unavailable. It also asks stakeholders to evaluate each asset’s internet exposure.

Why this matters

Analysis, not new reporting. AhsayCBS is a backup server, so a compromise can give an attacker a foothold on a system that holds copies of other systems’ data and often has broad network reach. The flaw needs no authentication, so an AhsayCBS instance reachable from the internet is the highest-risk case. Instances reachable only from an internal network are lower risk, but still worth patching quickly given the published exploit and the short due date.

How to detect exploitation

The sources contain no indicators of compromise, so there are no IOCs to share. Based on the facts above, these are sensible hunting ideas:

Search web server and proxy logs for requests to /rps/api/json/UpdateReceivers.do, especially from unfamiliar external addresses or with unusual values in the random parameter.
Look for the AhsayCBS service spawning shells or other unexpected child processes.
Review the server for new accounts, scheduled tasks or unexpected outbound connections after the first request you find.
Check backup jobs and stored data for unexpected changes or deletions.

What to do

Inventory every AhsayCBS server and record its version.
Upgrade to 10.3.4 or later. The vendor release notes are linked in the sources below.
Do the same check for CVE-2026-105133, since CISA says the two can be chained.
If you cannot patch immediately, remove the server from direct internet exposure or restrict access to trusted addresses, and follow the vendor’s mitigation guidance.
Hunt for signs of earlier exploitation using the ideas above, as a public exploit has been available since before the KEV listing.
Meet the CISA due date of 2026-10-17 if you are a federal agency, and treat it as a sensible target if you are not.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.