Read the docs
TI-2026-67515 Aliases CVE-2026-105134GHSA-mxj3-2x8q-2rh9

OS command injection in Ahsay AhsayCBS Replication Receiver

Priority CRITICAL 100Exploited in the wildCWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Ahsay AhsayCBS versions up to 9.15.2.69 and up to 10.3.4.44 contain an OS command injection flaw (CWE-78) in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint. A crafted value in the random argument lets an unauthenticated remote attacker run operating system commands on the server. A public exploit has been published, and CISA reports active exploitation and lists the flaw in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-14CISA due date 2026-10-17
EPSS 0.81763 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed AhsayCBS (Ahsay): 9.15.2.70, 10.3.4.45

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AhsayAhsayCBS9.15.2.0; 9.15.2.1; 9.15.2.2; 9.15.2.3; 9.15.2.4; 9.15.2.5; 9.15.2.6; 9.15.2.7; 9.15.2.8; 9.15.2.9; 9.15.2.10; 9.15.2.11; 9.15.2.12; 9.15.2.13; 9.15.2.14; 9.15.2.15; 9.15.2.16; 9.15.2.17; 9.15.2.18; 9.15.2.19; 9.15.2.20; 9.15.2.21; 9.15.2.22; 9.15.2.23; 9.15.2.24; 9.15.2.25; 9.15.2.26; 9.15.2.27; 9.15.2.28; 9.15.2.29; 9.15.2.30; 9.15.2.31; 9.15.2.32; 9.15.2.33; 9.15.2.34; 9.15.2.35; 9.15.2.36; 9.15.2.37; 9.15.2.38; 9.15.2.39; 9.15.2.40; 9.15.2.41; 9.15.2.42; 9.15.2.43; 9.15.2.44; 9.15.2.45; 9.15.2.46; 9.15.2.47; 9.15.2.48; 9.15.2.49; 9.15.2.50; 9.15.2.51; 9.15.2.52; 9.15.2.53; 9.15.2.54; 9.15.2.55; 9.15.2.56; 9.15.2.57; 9.15.2.58; 9.15.2.59; 9.15.2.60; 9.15.2.61; 9.15.2.62; 9.15.2.63; 9.15.2.64; 9.15.2.65; 9.15.2.66; 9.15.2.67; 9.15.2.68; 9.15.2.69; 10.3.4.0; 10.3.4.1; 10.3.4.2; 10.3.4.3; 10.3.4.4; 10.3.4.5; 10.3.4.6; 10.3.4.7; 10.3.4.8; 10.3.4.9; 10.3.4.10; 10.3.4.11; 10.3.4.12; 10.3.4.13; 10.3.4.14; 10.3.4.15; 10.3.4.16; 10.3.4.17; 10.3.4.18; 10.3.4.19; 10.3.4.20; 10.3.4.21; 10.3.4.22; 10.3.4.23; 10.3.4.24; 10.3.4.25; 10.3.4.26; 10.3.4.27; 10.3.4.28; 10.3.4.29; 10.3.4.30; 10.3.4.31; 10.3.4.32; 10.3.4.33; 10.3.4.34; 10.3.4.35; 10.3.4.36; 10.3.4.37; 10.3.4.38; 10.3.4.39; 10.3.4.40; 10.3.4.41; 10.3.4.42; 10.3.4.43; 10.3.4.449.15.2.70, 10.3.4.45Patch availableCNA
  • AhsayCBS VendorAhsay Affected 9.15.2.0; 9.15.2.1; 9.15.2.2; 9.15.2.3; 9.15.2.4; 9.15.2.5; 9.15.2.6; 9.15.2.7; 9.15.2.8; 9.15.2.9; 9.15.2.10; 9.15.2.11; 9.15.2.12; 9.15.2.13; 9.15.2.14; 9.15.2.15; 9.15.2.16; 9.15.2.17; 9.15.2.18; 9.15.2.19; 9.15.2.20; 9.15.2.21; 9.15.2.22; 9.15.2.23; 9.15.2.24; 9.15.2.25; 9.15.2.26; 9.15.2.27; 9.15.2.28; 9.15.2.29; 9.15.2.30; 9.15.2.31; 9.15.2.32; 9.15.2.33; 9.15.2.34; 9.15.2.35; 9.15.2.36; 9.15.2.37; 9.15.2.38; 9.15.2.39; 9.15.2.40; 9.15.2.41; 9.15.2.42; 9.15.2.43; 9.15.2.44; 9.15.2.45; 9.15.2.46; 9.15.2.47; 9.15.2.48; 9.15.2.49; 9.15.2.50; 9.15.2.51; 9.15.2.52; 9.15.2.53; 9.15.2.54; 9.15.2.55; 9.15.2.56; 9.15.2.57; 9.15.2.58; 9.15.2.59; 9.15.2.60; 9.15.2.61; 9.15.2.62; 9.15.2.63; 9.15.2.64; 9.15.2.65; 9.15.2.66; 9.15.2.67; 9.15.2.68; 9.15.2.69; 10.3.4.0; 10.3.4.1; 10.3.4.2; 10.3.4.3; 10.3.4.4; 10.3.4.5; 10.3.4.6; 10.3.4.7; 10.3.4.8; 10.3.4.9; 10.3.4.10; 10.3.4.11; 10.3.4.12; 10.3.4.13; 10.3.4.14; 10.3.4.15; 10.3.4.16; 10.3.4.17; 10.3.4.18; 10.3.4.19; 10.3.4.20; 10.3.4.21; 10.3.4.22; 10.3.4.23; 10.3.4.24; 10.3.4.25; 10.3.4.26; 10.3.4.27; 10.3.4.28; 10.3.4.29; 10.3.4.30; 10.3.4.31; 10.3.4.32; 10.3.4.33; 10.3.4.34; 10.3.4.35; 10.3.4.36; 10.3.4.37; 10.3.4.38; 10.3.4.39; 10.3.4.40; 10.3.4.41; 10.3.4.42; 10.3.4.43; 10.3.4.44 Fixed in 9.15.2.70, 10.3.4.45 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*before 9.15.2.70; 10.1.0 to before 10.3.4.45VulnerableAhsay
  • cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:* Versions before 9.15.2.70; 10.1.0 to before 10.3.4.45 Vulnerable ·Ahsay

Remediation

Upgrade the affected AhsayCBS installation to version 9.15.2.70 or 10.3.4.45, according to the branch in use. CISA requires U.S. federal agencies to fix this vulnerability by 2026-10-17.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA AhsayCBS (Ahsay) Fixed in 9.15.2.70, 10.3.4.45

Timeline

  1. 2026-10-04 Threatist record created from CVE-2026-105134
  2. 2026-10-04 Alias added: GHSA-mxj3-2x8q-2rh9
  3. 2026-10-05 CISA SSVC decision points changed
  4. 2026-10-14 Added to CISA KEV
  5. 2026-10-15 Priority changed: MEDIUM → CRITICAL
  6. 2026-10-15 CISA SSVC decision points changed
  7. 2026-10-16 EPSS moved to the 90th–95th percentile
  8. 2026-10-23 EPSS moved to the 95th–99th percentile
  9. 2026-10-25 EPSS moved to the 99th percentile and above
  10. 2026-10-26 CVSS score changed · CNA
  11. 2026-10-26 Fix available: Ahsay/[email protected], Ahsay/[email protected] · CNA
  12. 2026-10-26 2 new references · CNA

References

Exploit 1

Patch 1

  • TI-2026-67514 Improper authentication in Ahsay AhsayCBS API KEVCVSS 4.0MEDIUM 6.9
  • TI-2019-07579 An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup… CVSS 3.0HIGH 8.8
  • TI-2022-17231 Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM… CVSS 3.1HIGH 7.2
  • TI-2019-07578 An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. CVSS 3.0HIGH 7.5
  • TI-2020-04766 An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup… CVSS 3.1HIGH 8.8
  • TI-2019-07577 An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. CVSS 3.0HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences