AhsayCBS-Auth-Bypass-RCE

AhsayCBS Authentication Bypass & RCE CVE-2026-105133 + CVE-2026-105134 — Unauthenticated remote code execution in AhsayCBS ≤10.3.4 Blog Post Technical analysis covering root cause, exploitation, and indicators of compromise is available on the Horizon3.ai attack research blog:...

AhsayCBS <= 10.3.4 - Unauthenticated RCE

Ahsay AhsayCBS = 10.3.2 contains a command injection caused by manipulation of the "random" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request id: CVE-2026-105134 info: name: AhsayCBS = 10.3.4 -...

AhsayCBS - JSON API Authentication Bypass

Ahsay AhsayCBS = 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation. id: CVE-2026-105133 info: name: AhsayCBS - JSON API...

Ahsay CBS CVE-2026-105134 UpdateReceivers command injection

CVE-2026-105134: Ahsay AhsayCBS Replication Receiver POST /rps/api/json/UpdateReceivers.do passes the JSON random field into a shell command without sanitization. Supports confirm-only echo injection whoami/id when stdout is reflected in JSON, or time-based check. !/usr/bin/env python3 -- coding:...

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134 , which could be chained to...

AhsayCBS-Auth-Bypass-RCE

AhsayCBS Authentication Bypass & RCE CVE-2026-105133 + CVE-...

Vulnerabilities hidden in Ahsay AhsayCBS

Ahsay has fixed vulnerabilities in AhsayCBS up to version 10.3.2. The vulnerability with identifier CVE-2026-105133 has a CVSS score of 7.3 and involves insufficient authentication in the checkSysPwd function of the AhsayCBS API. An unauthorized malicious actor could exploit this vulnerability to...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-10513...

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 CVSS v4 score: 5.5 - An improper authentication...

VulnCheck KEV: CVE-2026-105133

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

VulnCheck KEV: CVE-2026-105134

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch...

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate...

CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch...

EUVD-2026-92078

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

CVE-2026-105134

AhsayCBS versions up to 10.3.2 are vulnerable to remote OS command injection in the Replication Receiver component. The flaw exists in the /rps/api/json/UpdateReceivers.do endpoint, where the random argument is improperly neutralized, allowing attackers to execute arbitrary commands remotely. Thi...

CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch...