Description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Published: 2026-10-04
Score: 10 Critical
EPSS: 86.3% High
KEV: Yes
Impact: Remote OS Command Execution
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the Replication Receiver component of Ahsay CBS, specifically the /rps/api/json/UpdateReceivers.do endpoint. A crafted value for the random argument causes the application to execute an arbitrary operating‑system command, allowing an attacker to execute code with the privileges of the replication receiver process.

Affected Systems

Ahsay CBS (Ahsay: AhsayCBS) is affected. Versions up to 9.15.2.69 and 10.3.4.44 contain the flaw. The vendor released fixes in 9.15.2.70 and 10.3.4.45.

Risk and Exploitability

The CVSS score of 10 classifies the flaw as critical. The EPSS score of 86% indicates a very high probability of exploitation, and the vulnerability is listed in CISA KEV, confirming that exploit code exists and has been used. The attack vector is a remote HTTP request; the CVE description does not specify whether authentication is required to exploit the flaw.

Generated by OpenCVE AI on October 26, 2026 at 17:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Ahsay CBS installation to version 9.15.2.70 or 10.3.4.45 to apply the vendor patch that sanitizes the random parameter and blocks command injection.
  • Implement strict input validation for the random parameter: enforce an allow‑list (e.g., alphanumeric and limited punctuation) or properly escape shell metacharacters before invoking system calls. This directly mitigates the CWE‑77/CWE‑78 OS command injection risk.
  • If an upgrade is not immediately possible, restrict access to the /rps/api/json/UpdateReceivers.do endpoint to trusted IPs or internal networks and use a WAF rule to block any request containing shell metacharacters, helping to contain the injection vector.
  • Apply the principle of least privilege to the OS account under which the replication receiver process runs, so that even if a command injection succeeds, the attacker cannot gain higher‑level system access.

Generated by OpenCVE AI on October 26, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
References

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised. A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

 cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A'}

Thu, 15 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Ahsay cloud Backup Suite
CPEs cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
Vendors & Products Ahsay cloud Backup Suite

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-14T00:00:00+00:00', 'dueDate': '2026-10-17T00:00:00+00:00'}

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 04 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Title Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
First Time appeared Ahsay
Ahsay ahsaycbs
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*
Vendors & Products Ahsay
Ahsay ahsaycbs
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Ahsay Ahsaycbs Cloud Backup Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T14:31:13.988Z

Reserved: 2026-10-03T13:13:35.953Z

Link: CVE-2026-105134

cve-icon Vulnrichment

Updated: 2026-10-05T15:40:40.465Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-04T07:16:33.480

Modified: 2026-10-26T18:06:57.930

Link: CVE-2026-105134

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T18:00:08Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')