Source: cisa.gov
CVE-2026-105134 is a command injection vulnerability affecting Ahsay AhsayCBS backup software. The flaw resides in the Replication Receiver component, specifically the /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the 'random' parameter allows a remote attacker to execute arbitrary operating system commands. This vulnerability can be chained with CVE-2026-105133 to potentially increase the severity or scope of exploitation. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Organizations using AhsayCBS are urged to apply the vendor-released patch immediately. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance. The vulnerability is catalogued in the NVD and carries a high criticality rating.
