Critical Command Injection in AhsayCBS Exposed via Replication API (CVE-2026-105134)

An unauthenticated command injection vulnerability in Ahsay Cloud Backup Suite (AhsayCBS), tracked as CVE-2026-105134, poses a severe risk to organizations hosting centralized backup infrastructure. Carrying a maximum CVSS score of 10.0, the vulnerability enables remote, unauthenticated attackers to execute arbitrary system commands on the underlying server without any prior privileges or user interaction.

Technical Mechanics

The flaw resides within the Replication Receiver component of AhsayCBS, specifically in how the /rps/api/json/UpdateReceivers.do endpoint processes incoming API calls. By manipulating the random parameter during a request, an adversary can inject operating system commands directly into the server’s execution context (CWE-77/CWE-78).

The underlying metric vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) highlights two critical characteristics of this vulnerability:

1. Low Attack Complexity with Zero Privileges: Anyone who can reach the HTTP/HTTPS port serving the API endpoint can attempt the exploit.
2. Scope Change (S:C): Code execution on the backup application layer translates directly to full control over the hosting operating system, enabling attackers to break beyond the application boundary to pivot across attached network segments, alter file permissions, or wipe storage arrays.

This flaw can also be chained alongside CVE-2026-105133 to expand post-exploitation control. While the current EPSS probability sits at 3.2% (placing it in the 88th percentile of scored vulnerabilities), backup management endpoints accessible over the public internet represent high-priority targets that draw rapid automated exploitation attempts.

Why Backup Infrastructure Is Targeted

Centralized backup management servers like AhsayCBS are high-value targets for ransomware operators and extorting threat groups. Compromising the backup server gives an attacker immediate leverage:

• Data Exfiltration: Access to stored tenant backups allows mass exfiltration of sensitive files across all managed endpoints.
• Ransomware Preparation: Prior to encrypting primary operational infrastructure, attackers deliberately purge or destroy backups to reduce recovery options and force ransom payment.
• Credential Harvesting: Backup platforms frequently store administrative credentials or service tokens used to communicate with client agents across multiple customer networks.

Given that the Replication Receiver component frequently needs to be reachable across WAN connections to accept offsite backups from remote agents, internet exposure for this endpoint is extremely common.

Required Mitigation Actions

Organizations using Ahsay Cloud Backup Suite must take immediate action:

• Upgrade Target Systems: Update all AhsayCBS instances to version 10.3.4 or higher, which addresses the unsanitized input processing in the UpdateReceivers.do handler.
• Network Access Controls: If upgrading cannot be performed immediately, restrict network-level access to the /rps/api/json/ directory and block public access to the Replication Receiver component, allowing traffic only from trusted static IP addresses of managed replication partners.
• Incident Response & Forensics Triage: Because this vulnerability allows unprivileged command execution, perform forensic triage on internet-facing AhsayCBS host servers—focusing on web server process trees (java.exe or web server child processes spawning cmd.exe or /bin/sh) and unusual outbound connections from the host—prior to applying updates.