# CVE-2026-105134: Ahsay AhsayCBS OS command injection in UpdateReceivers

Source: https://junglewise.ai/threats/cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105134 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-10-04

Ahsay AhsayCBS is a cloud backup and recovery solution used by organizations to protect their data. An attacker can exploit a flaw in the UpdateReceivers API endpoint to inject arbitrary operating system commands, potentially gaining full control of the backup server and compromising all protected data.

## Quick answers

**Is CVE-2026-105134 exploited in the wild?** Yes. CVE-2026-105134 is known to be exploited in the wild, first recorded on 14 October 2026. Treat it as urgent.

**How severe is CVE-2026-105134?** Critical severity, with a CVSS score of 10, published 4 October 2026.

**Which products and versions are affected?** AhsayCBS up to 10.3.2.

**Is there a fix for CVE-2026-105134?** Yes: fixed in 10.3.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105134 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105134?** Check whether you run AhsayCBS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.3.4

## Technical details

The Replication Receiver component in AhsayCBS contains an OS command injection vulnerability in the /rps/api/json/UpdateReceivers.do endpoint, where the "random" parameter is not properly sanitized. An unauthenticated remote attacker can craft a malicious request to execute arbitrary commands with the privileges of the backup server process, leading to complete system compromise.

## Affected products

- Ahsay AhsayCBS up to 10.3.2

## Timeline

- 2026-10-04: disclosed
- 2026-10-04: advisory

## References

- [https://vuldb.com/cve/CVE-2026-105134](https://vuldb.com/cve/CVE-2026-105134)
- [https://vuldb.com/submit/942743](https://vuldb.com/submit/942743)

## Related threats

- [Ahsay AhsayCBS authentication bypass in API](https://junglewise.ai/threats/cve-2026-105133-a-vulnerability-was-detected-in-ahsay-ahsaycbs-up-to-10-3-2-this)