CVE-2026-105134 · Critical · CISA KEV

AhsayCBS Command Injection: Critical Vulnerability Actively Exploited in the Wild

Threat Engine Auto-Feed · data current as of 2026-10-15

CVE-2026-105134 is a critical command injection vulnerability in AhsayCBS's Replication Receiver component, allowing remote OS command execution. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA KEV, and has an EPSS score in the 88th percentile, indicating a high likelihood of future exploitation. It can be chained with CVE-2026-105133 for potentially broader impact.

  • CVSS:
  • EPSS percentile: 0.88063
  • Exploitation pressure: 78/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 88th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is a command injection, which occurs when an application constructs a command using external input without proper validation or sanitization. An attacker can manipulate this input to inject and execute arbitrary operating system commands on the underlying system where the application is running, bypassing intended security controls.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any organization using AhsayCBS, particularly those in Financial services or Technology sectors, due to assessed targeting by sophisticated threat actors.
  • Organizations with critical data backed up or managed by AhsayCBS, as compromise could lead to data exfiltration or integrity loss.

Misconfigurations that escalate it

  • Lack of network segmentation for backup infrastructure, allowing attackers to reach the Replication Receiver component.
  • Insufficient monitoring of AhsayCBS logs for unusual command execution or API calls.

High-impact scenarios

  • Remote code execution on the AhsayCBS server, leading to full system compromise.
  • Data exfiltration from backup repositories or disruption of backup operations.
  • Lateral movement within the network from the compromised backup server to other critical assets.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor network traffic for unusual requests to the /rps/api/json/UpdateReceivers.do endpoint on AhsayCBS servers.
  • Review AhsayCBS server logs for unexpected operating system command executions or errors related to the Replication Receiver component.
  • Implement endpoint detection and response (EDR) solutions on AhsayCBS servers to detect anomalous process creation or suspicious activity.

Contain

  • Isolate affected AhsayCBS servers from the network to prevent further compromise.
  • Block network access to the /rps/api/json/UpdateReceivers.do endpoint if immediate patching is not feasible, while assessing impact on legitimate replication.
  • Review and revoke any potentially compromised credentials associated with the AhsayCBS service.

Patch

  • Apply the latest security updates and patches from Ahsay for AhsayCBS to address CVE-2026-105134 and CVE-2026-105133.

Frontier verdict — Critical

This is a critical, actively exploited command injection vulnerability in AhsayCBS with high exploitation pressure, requiring immediate patching to prevent remote system compromise.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.