- Critical 9.3
- Known exploited (CISA KEV)
CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Scores
The facts
- Published
- 4 October 2026
- Last changed
- 15 October 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.3 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- ahsay cloud backup suite
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 14 October 2026.
- EPSS
- 4.8% chance of exploitation activity in the next 30 days (percentile 92).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.