---
id: CVE-2026-105134
title: A flaw has been found in Ahsay AhsayCBS up to 10.3.2
summary: >-
  A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability
  affects unknown code of the file /rps/api/json/UpdateReceivers.do of the
  component Replication Receiver. Executing a manipulation of the argument
  random can lead to…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-77
  - CWE-78
vendor: ahsay
product: cloud_backup_suite
affected:
  - cloud_backup_suite < 10.3.4
patched:
  - cloud_backup_suite 10.3.4
published: '2026-10-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T13:47:12.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105134'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-105134'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/942743'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413351'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413351/cti'
    label: cna@vuldb.com
  - url: 'https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4'
    label: cna@vuldb.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
  - url: 'https://www.huntress.com/blog/ahsaycbs-flaws-exploit'
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.81763
epssPercentile: 0.99643
kev: true
kevDateAdded: '2026-10-14'
kevDueDate: '2026-10-17'
kevRansomware: false
exploited: true
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/RayanAlmulhim/CVE-2026-105134-lab'
  nuclei:
    - CVE-2026-105134
  checkedAt: '2026-10-27T16:54:16.968Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-14T19:32:43.962562Z'
ingestedAt: '2026-10-04T06:55:02.312Z'
---

## Overview

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

## Affected

- `cloud_backup_suite < 10.3.4`

## Remediation

Upgrade past the affected range:

- `cloud_backup_suite 10.3.4`