What happened
A command injection vulnerability has been identified in Ahsay AhsayCBS, a data backup and recovery platform. The flaw resides in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the random parameter can enable a remote attacker to execute operating system commands. This vulnerability has already been exploited actively in the wild, increasing the risk associated with affected deployments.
The issue is classified as critical, with confirmed exploits targeting the vulnerability. The underlying weaknesses include CWE-77 (OS Command Injection) and CWE-78 (OS Command Injection), which facilitate the execution of arbitrary commands within the affected environment. Attackers can leverage this flaw to potentially compromise impacted systems and access sensitive data or disrupt operations.
The vulnerability can be chained with CVE-2026-105133, further exacerbating the impact. Incident response authorities, such as CISA, advise stakeholders to act swiftly to address this issue. Exploitation scenarios involve an attacker remotely manipulating the vulnerable parameter, highlighting the importance of immediate mitigation measures.
Who is affected
Organizations running Ahsay AhsayCBS that have not implemented specific mitigations are potentially vulnerable. Affected deployments include those exposed to internet access where the endpoint identified in the vulnerability report is accessible. No information is available regarding specific versions or build numbers; therefore, all relevant instances should be reviewed for potential exposure.
The vulnerability’s active exploitation underscores the urgency for affected entities to evaluate their internet-facing assets and verify whether the compromised endpoint is reachable externally. Stakeholders are responsible for assessing their environments, particularly cloud-based or externally accessible instances, in line with regulatory guidance.
Recommended actions
Apply mitigations in accordance with vendor instructions provided for Ahsay AhsayCBS. Ensure that all steps to neutralise the command injection vulnerability are followed thoroughly.
Follow the guidance outlined by CISA, including compliance with BOD 26-04 Prioritizing Security Updates Based on Risk, and the “Forensics Triage Requirements”.
For cloud deployments or environments where patching is not feasible, consider discontinuing use of the affected component until mitigations are in place.
Assess internet exposure of Ahsay AhsayCBS instances, particularly those accessible externally, and implement appropriate network controls to limit attack surface.
