CVE-2026-105134

Published Oct 4, 2026

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-105134 is an operating system command injection vulnerability affecting the Replication Receiver component of the AhsayCBS backup utility, specifically within the `/rps/api/json/UpdateReceivers.do` endpoint. The flaw stems from the improper neutralization of user-supplied input, which allows remote attackers to manipulate the `random` argument. The affected API also contains an authentication bypass mechanism that permits a random token to substitute for valid credentials. Consequently, remote, unauthenticated attackers can exploit this vulnerability to execute arbitrary commands with system privileges (such as NT AUTHORITY\SYSTEM) on the host. In active campaigns, threat actors have been observed chaining CVE-2026-105134 with CVE-2026-105133—an improper authentication flaw in the utility's `checkSysPwd` function—to bypass authentication and achieve remote code execution. After gaining access, attackers configure a malicious replication receiver and drop Java Server Page (JSP) web shells into the application directory. These intrusions are typically followed by reconnaissance and the deployment of payloads, such as XMRig cryptocurrency miners disguised as Microsoft Edge processes, alongside evasion scripts designed to terminate mining activities if administrative monitoring tools are opened.

Description: A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Source: cna@vuldb.com
NVD status: Deferred

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Secondary
Base score: 10
Impact score: 10
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

cna@vuldb.com: CWE-77

Hype score: Not currently trending

References

Sources include official advisories and independent security research.