Threat database

AhsayCBS backup utility versions up to 10.3.4 contain a vulnerability (CVE-2026-105133) that allows unauthenticated remote code execution. Exploitation involves chaining two critical vulnerabilities to bypass authentication and execute code with SYSTEM privileges. Attackers have deployed webshells, cryptocurrency miners disguised as legitimate processes, and persistence mechanisms including fake Windows services and kernel driver exploitation. Managed service providers are primarily targeted.

A critical OS command injection vulnerability exists in Ahsay AhsayCBS versions 10.3.0, 10.3.1, and 10.3.2. The flaw is in the Replication Receiver component, specifically in the /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the 'random' argument can lead to remote command execution. Exploit code has been published. Upgrading to version 10.3.4 resolves the issue.