CVE-2026-105134
CRITICAL CISA KEV
ACT NOW
Priority: 8.18
BB Relevance:
90/100
Published: 2026-10-04
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
CISA Known Exploited Vulnerability
Vendor / Product
Ahsay — AhsayCBS
Date Added
2026-10-14
Remediation Due
2026-10-17
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| ahsay | cloud_backup_suite | < 9.15.2.70 |
| ahsay | cloud_backup_suite | 10.1.0 – 10.3.4.45 |
References & Advisories (7)
Vendor Advisory
US Government Resource
Third Party Advisory
VDB Entry
Third Party Advisory
VDB Entry
Third Party Advisory
Permissions Required
VDB Entry
Permissions Required
VDB Entry