Unauthenticated command injection via the Replication Receiver UpdateReceivers.do endpoint in AhsayCBS backup servers (CVE-2026-105134)
CISA added the flaw to KEV on 2026-10-14 with a 2026-10-17 due date, a public exploit and detailed technical write-ups from Huntress and Horizon3 are available, and Ahsay has issued follow-up fixes after its initial patches were reported incomplete — a server on 10.3.4 or earlier without the 10.3.4.45 hotfix is open to web shell deployment.
The random parameter of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do in AhsayCBS is passed into operating system commands, and when chained with the authentication bypass CVE-2026-105133 it gives a remote attacker code execution on the backup server. Huntress reports attackers using the chain to plant web shells and the XMRig cryptominer on exposed servers.
Affected: AhsayCBS 10.3.0; AhsayCBS 10.3.1; AhsayCBS versions up through 10.3.4 (v10 before the 10.3.4.45 hotfix)
How to Test
Check the AhsayCBS version in the CBS console; versions up through 10.3.4 are affected, so confirm you have Ahsay's 10.3.4.45 hotfix (9.15.2.70 on v7, v8 and v9) or a later fix for CVE-2026-105133/105134. Review web server logs for requests to /rps/api/json/UpdateReceivers.do, particularly ones with unusual values in the random parameter or arriving without a valid session, and for preceding API calls consistent with the CVE-2026-105133 authentication bypass. Look for unexpected web shell files under the CBS web root, unknown CPU-heavy processes (XMRig), and unrecognised or modified administrator accounts; treat any of these as compromise and rotate credentials for the server and connected backup destinations.
How to Patch
Upgrade AhsayCBS to 10.3.4 or later and apply Ahsay's latest patch update for CVE-2026-105133/105134, since the initial fixes were reported incomplete. Until the upgrade is done, restrict network access to the CBS console and Replication Receiver (/rps/) to trusted hosts only.