CVE-2026-105134: Critical AhsayCBS Command Injection

What CVE-2026-105134 is and who is affectedAhsay AhsayCBS, the backup and replication server used by many managed service providers and SMEs to protec...

What CVE-2026-105134 is and who is affected

Ahsay AhsayCBS, the backup and replication server used by many managed service providers and SMEs to protect their data, carries a critical command injection vulnerability tracked as CVE-2026-105134. According to the National Vulnerability Database (NVD) of NIST, the flaw affects AhsayCBS up to version 10.3.2 and sits in the Replication Receiver component, specifically in the file /rps/api/json/UpdateReceivers.do. A remote attacker can manipulate the random parameter to execute operating system commands on the underlying server.

The vulnerability is classified as CWE-77 and CWE-78 (command injection) and carries a CVSS 4.0 score of 9.3 (CRITICAL). The vector shows network exploitability with no privileges or user interaction required, and high impact on confidentiality, integrity and availability. In short: an unauthenticated attacker who can reach the endpoint may be able to run arbitrary commands on the backup server. CISA also notes that this flaw can be chained with CVE-2026-105133, which raises the potential impact for organisations that have not yet patched.

Any Spanish SME, ecommerce business or IT team running AhsayCBS on a version up to 10.3.2 — whether on-premise or exposed through a remote replication setup — should treat this as a priority. The product is often installed on a dedicated server with broad access to backup data, which makes it an attractive target for attackers.

Why it is urgent: active exploitation and a tight CISA deadline

This is not a theoretical risk. CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026, confirming that the flaw is being exploited in real-world attacks. The NVD also states that an exploit has been published and may be used, which lowers the barrier for less skilled attackers.

CISA has given US federal agencies until 17 October 2026 to apply mitigations in line with vendor instructions, following its BOD 26-04 guidance on prioritising security updates based on risk. While that deadline applies to US federal bodies, the message for European organisations is the same: the window between disclosure and exploitation is now measured in days, not months. For companies in Barcelona, Lleida, Tarragona or Girona running AhsayCBS, the practical deadline is effectively now.

The fact that CISA links this vulnerability to its “Forensics Triage Requirements” also signals that organisations should not only patch but also check whether they have already been compromised. Command injection flaws of this type often leave traces in server logs, unusual processes or unexpected outbound connections.

What to do today

Start by confirming whether AhsayCBS is in use and which version is running. If the version is 10.3.2 or lower, the NVD advises upgrading to version 10.3.4, which resolves the issue. Where an immediate upgrade is not possible, apply the mitigations described in the vendor’s release notes and security advisory, and restrict access to the Replication Receiver endpoint as much as possible.

Inventory: check all servers, virtual machines and cloud instances for AhsayCBS installations, including test or forgotten environments.
Patch: upgrade to 10.3.4 or later as indicated by the vendor. If you cannot upgrade immediately, follow the vendor’s mitigation instructions exactly.
Reduce exposure: the endpoint should not be reachable from the public internet unless strictly necessary. Use firewall rules, VPNs or IP allow-lists to limit who can reach it.
Review for intrusion: inspect logs for requests to /rps/api/json/UpdateReceivers.do with unusual random parameters, unexpected system commands, new user accounts, or outbound connections to unknown hosts.
Check the chain: because CVE-2026-105134 can be combined with CVE-2026-105133, review whether the related flaw is also present and address it at the same time.

If you find signs of compromise, treat the server as untrusted: isolate it, preserve evidence, rotate credentials and restore from a clean backup once the vulnerability is closed.

How a cybersecurity team like ALMC can help

For SMEs and ecommerce businesses without a dedicated security department, keeping on top of critical CVEs like this one is a full-time job. At ALMC we work with companies across Catalonia and Spain to detect and close vulnerabilities before they are exploited. That includes security audits and pentesting, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations. We also repair websites that have already been hacked and help clients understand what happened and how to prevent a repeat.

In a case like CVE-2026-105134, our role is to help you confirm whether the affected product is present, apply the vendor’s update or mitigation correctly, and verify that no attacker has already gained a foothold. If your IT team is small or stretched, having a partner who tracks CISA’s KEV catalogue and the NVD means these critical alerts turn into concrete actions rather than another item on a to-do list.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.