Search: CVE-2026-105134

CVE-2026-105134 is a critical OS command injection vulnerability in Ahsay AhsayCBS affecting versions up to 9.15.2.69 and 10.3.4.44. The flaw exists in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the 'random' argument allows remote attackers to execute arbitrary OS commands. Exploit code is publicly available and exploitation in the wild is confirmed. The initial patch was incomplete, but upgrading to versions 9.15.2.70 or 10.3.4.45 resolves the issue.

Starting October 7, 2026, attackers exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to perform unauthenticated remote code execution. They chained these flaws to bypass authentication and execute code with SYSTEM privileges. Post-exploitation, attackers deployed JSP webshells, installed XMRig cryptocurrency miners disguised as Microsoft Edge processes, and used an AI-assisted PowerShell script to hide mining activity by terminating Task Manager. Persistence was maintained via a fake Windows service named MicrosoftEdgeUpdateSvc. Additionally, a vulnerable kernel driver (WinRing0x64.sys) was exploited for kernel-level hardware access to optimize mining. All AhsayCBS versions through 10.3.4 are affected, with managed service providers primarily targeted.