CVE-2026-105134 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-04

Added to CISA KEV: 2026-10-14 10 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Upgrade AhsayCBS to version 10.3.4 or later without delay. This is a CVSS 10.0 vulnerability with confirmed active exploitation and public PoC code available.
CRITICAL — INCIDENT RESPONSE: If patching cannot be done instantly, assume compromise is possible. Conduct immediate forensic review of AhsayCBS server logs for anomalous API calls to /rps/api/json/UpdateReceivers.do, unexpected process spawning, new files in web directories (webshells), and unusual outbound network connections (XMRig C2 or crypto pool traffic).
IMMEDIATE MITIGATION (pre-patch): Restrict external network access to the AhsayCBS management and API ports using firewall rules or network ACLs. Limit access to /rps/api/json/ endpoints to known trusted IP ranges only. Place the server behind VPN if operationally feasible.
INDICATOR OF COMPROMISE CHECK: Search for webshell artifacts (JSP/ASPX/PHP files recently created in web root directories), XMRig process execution, unauthorized scheduled tasks or cron jobs, and unexpected listening ports or outbound connections on affected AhsayCBS servers.
MSP-SPECIFIC ACTION: If you are an MSP using AhsayCBS, notify your customers of potential data exposure. Treat all managed backup data as potentially accessed until forensic review confirms otherwise.
POST-PATCH: Review and harden network segmentation for AhsayCBS servers. Implement Web Application Firewall (WAF) rules to monitor API endpoints. Enable detailed logging on the AhsayCBS application and underlying OS for future detection.
PATCH PRIORITY: CRITICAL — treat as P0/emergency patch. Deploy within 24–48 hours on all internet-accessible instances. Internal-only instances should be patched within 72 hours.

🔍 Web Intelligence (Kagi · 2026-10-14)

Summary

CVE-2026-105134 is a critical command injection vulnerability affecting the Ahsay AhsayCBS backup software in versions up to 10.3.2. The flaw exists within the `/rps/api/json/UpdateReceivers.do` component, which improperly sanitizes user-supplied input. This vulnerability is highly significant because it allows unauthenticated, remote attackers to execute arbitrary commands on the underlying server, making it a severe threat to organizations relying on AhsayCBS for backup infrastructure.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, with reports confirming its use to deploy webshells and XMRig cryptominers ^[2]^[4].
Threat Actors: While specific advanced persistent threat (APT) groups have not been definitively named, the nature of the payloads (webshells and cryptominers) suggests opportunistic exploitation by multiple threat actor groups targeting internet-exposed backup servers.
Availability: Verified proof-of-concept (PoC) exploit code is publicly available ^[3].
Attack Prerequisites: This is a remote, unauthenticated vulnerability. No user interaction or local access is required for a successful attack.

Affected Products & Patches

Affected Versions: Ahsay AhsayCBS software up to and including version 10.3.2 ^[1]^[5].
Patches: Organizations are strongly advised to upgrade their AhsayCBS installation to a patched version that addresses this vulnerability ^[1].
Mitigations: In environments where patching cannot be performed immediately, access to the administrative and API endpoints (specifically those related to `/rps/api/json/`) should be restricted via network-level controls (e.g., firewalls or VPN requirements) to prevent unauthorized external access.

Impact

Access and Capability: Successful exploitation grants remote code execution (RCE) with the privileges of the service user, allowing attackers to install persistence mechanisms (webshells), exfiltrate data, or deploy malicious secondary payloads like cryptominers.
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk. Compromise of an AhsayCBS server often provides attackers deep access to the organization's entire backup repository, potentially leading to widespread data theft, total loss of backup integrity, or ransomware deployment.

Sources

CVE-2026-105134 in AhsayCBS - VulDB
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability is registered as CVE-2026-105134. Upgrading the affected component ...
We detected active exploitation of CVE-2026-105133 and ...
We detected active exploitation of CVE-2026-105133 and CVE-2026-105134—two recently disclosed vulnerabilities enabling remote code execution ...
CVE-2026-105134: Command Injection - PoC Available | TheHackerWire
[PoC Available] CVE-2026-105134 (Command Injection) is a Critical severity flaw (CVSS 10). A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code... Verified proof-of-concept exploit code, technical breakdown, and mitigation guidance.
Threat Actors Exploit Critical AhsayCBS Flaws to Drop ...
Threat actors are exploiting AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers.
NVD-CVE-2026-105134 - NIST
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of ...

🔴 CVE-2026-105134