AhsayCBS RCE actively exploited (CVE-2026-105134) [PoC]

Actively exploited in the wild - CVE-2026-105134 is a critical OS command injection flaw in Ahsay AhsayCBS up to 10.3.2 that grants unauthenticated attackers remote code execution on the backup server. Upgrade to 10.3.4 immediately; the exploit is public and confirmed in use.

Overview

AhsayCBS is a centralized backup server (the “CBS” in Ahsay Cloud Backup Suite) used by managed service providers and enterprises to run backup and replication infrastructure. The Replication Receiver component exposes an endpoint at /rps/api/json/UpdateReceivers.do. In versions up to 10.3.2, that endpoint accepts a random argument and passes it into a system command without adequate sanitization. An attacker who can reach the endpoint over the network can inject their own OS commands, which then execute with the privileges of the AhsayCBS service.

No authentication is required, no user interaction is needed, and the attack is fully remote. This combination is why the CVSS score is a maximum 10.0 and why CISA added the issue to the Known Exploited Vulnerabilities catalog.

Impact

Successful exploitation gives an attacker arbitrary command execution on the backup server. Because AhsayCBS frequently runs with elevated privileges and holds credentials for downstream storage and client systems, a compromise can cascade: attackers can read backup data, tamper with stored archives, pivot into the internal network, or deploy ransomware. For an MSP, a single compromised AhsayCBS instance can expose every customer whose backups it manages. The EPSS score of 1.8% understates the risk here - the confirmed in-the-wild exploitation and public exploit code matter more than a probabilistic forecast.

Remediation and Mitigation

• Upgrade to AhsayCBS 10.3.4, which resolves the flaw. Ahsay advises updating the affected Replication Receiver component.
• If you cannot patch immediately, block external access to /rps/api/json/UpdateReceivers.do at the reverse proxy or WAF and restrict the Replication Receiver port to trusted replication peers only.
• Audit logs for POST requests to that path with unexpected characters in the random parameter.
• Rotate credentials and storage keys held by any AhsayCBS instance that was internet-exposed.
• Review breach reports and security news for ongoing exploitation activity tied to this CVE.

Security Insight

Backup infrastructure is a recurring weak point because it is trusted, privileged, and often internet-facing for replication - exactly the profile attackers favor for pre-ransomware staging. The command injection itself is a straightforward input-handling failure: a parameter named “random” reaching a shell is an avoidable design flaw, and its maximum-severity rating reflects that the endpoint shipped without authentication or input validation. The speed at which this moved to confirmed exploitation, despite low EPSS odds, is a reminder that backup servers belong in the same patch urgency tier as edge devices, not in the “internal tooling, patch eventually” bucket.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs