CVE-2026-105134: AhsayCBS Command Injection Vulnerability Actively Exploited

Overview

CVE-2026-105134 is a critical command injection vulnerability impacting Ahsay AhsayCBS backup software, specifically within its Replication Receiver component. This flaw enables unauthenticated remote attackers to execute arbitrary operating system commands by manipulating the random parameter in the /rps/api/json/UpdateReceivers.do endpoint. The vulnerability is actively exploited, with observed attacks deploying webshells and XMRig cryptominers.

Technical Analysis

This vulnerability exists in Ahsay AhsayCBS versions up to 10.3.2. The flaw is located in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. A remote attacker can achieve OS command injection by manipulating the random argument within requests to this endpoint. The vulnerability has a CVSS 3.1 score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network-exploitable, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

• Affected Component: Replication Receiver
• Affected Endpoint: /rps/api/json/UpdateReceivers.do
• Vulnerable Parameter: random
• Affected Versions: Ahsay AhsayCBS up to 10.3.2
• Attack Vector: Remote, unauthenticated command injection via HTTP/HTTPS requests.
• Weaknesses: CWE-77 (Improper Neutralization of Special Elements used in a Command (‘Command Injection’)), CWE-78 (Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’))
• Chaining: This vulnerability can be chained with CVE-2026-105133 for potentially broader impact.
• Post-Exploitation: Observed post-exploitation activities include the deployment of webshells and XMRig cryptominers.

Detection

Defenders can identify exploitation attempts and post-exploitation activity through various log sources and behavioral indicators:

• Web Server Logs: Monitor access logs for requests to /rps/api/json/UpdateReceivers.do where the random parameter in the query string or POST body contains suspicious characters indicative of command injection (e.g., &, |, ;, $(, `).
• Process Creation Logs (Windows/Linux): Look for unusual child processes spawned by the AhsayCBS service process (e.g., AhsayCBS.exe, java.exe, or similar) that include cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
• File System Monitoring: Detect the creation of suspicious files in web root directories (e.g., .jsp, .php, .asp, .aspx files that are not part of the legitimate application) or the presence of known cryptominer executables like xmrig.exe.
• Network Activity: Monitor for outbound connections from the AhsayCBS server to unusual IP addresses or domains, especially those associated with cryptomining pools or C2 infrastructure.
• Resource Utilization: Look for sudden spikes in CPU usage on the AhsayCBS server, which could indicate cryptomining activity.

Sigma Detection Rules

AhsayCBS CVE-2026-105134 Exploitation Attempt

title: AhsayCBS CVE-2026-105134 Exploitation Attempt
id: 7e2f1b3c-d4a5-4e6f-8b0c-9a1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2026-105134 in AhsayCBS by looking for suspicious requests to the vulnerable endpoint with command injection patterns.
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/rps/api/json/UpdateReceivers.do'
  selection_injection_patterns:
    cs-uri-query|contains:
      - '&'
      - '|'
      - ';'
      - '`'
      - '$('
      - '||'
      - '&&'
  condition: selection_uri and selection_injection_patterns
level: high

AhsayCBS Service Spawning Suspicious Processes

title: AhsayCBS Service Spawning Suspicious Processes
id: 8c9d0e1f-a2b3-4c5d-6e7f-0a1b2c3d4e5f
status: experimental
description: Detects post-exploitation activity where the AhsayCBS service process spawns common command interpreters, indicative of command injection success.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\AhsayCBS.exe'
      - '\java.exe' # Common for Java-based services
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection_parent and selection_child
level: critical

XMRig Cryptominer Execution

title: XMRig Cryptominer Execution
id: 9d0e1f2a-b3c4-5d6e-7f8a-9b0c1d2e3f4a
status: experimental
description: Detects the execution of XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-105134.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmrig-proxy.exe'
    CommandLine|contains:
      - '--donate-level'
      - '-o pool.supportxmr.com'
      - '-u wallet_address'
  condition: selection
level: high

Mitigations

1. Patch Immediately: Upgrade Ahsay AhsayCBS to version 10.3.4 or later. This is the primary and most effective mitigation.
2. Network Segmentation: Isolate AhsayCBS servers on a dedicated network segment with strict egress filtering to limit outbound connections and prevent lateral movement in case of compromise.
3. Principle of Least Privilege: Ensure the AhsayCBS service runs with the minimum necessary privileges to perform its functions.
4. Application Whitelisting: Implement application whitelisting to prevent the execution of unauthorized executables (e.g., xmrig.exe, unknown scripting interpreters) on the server.
5. Regular Backups: Maintain regular, off-site, and immutable backups of critical data to facilitate recovery in the event of a successful attack.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-105134
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
• https://vuldb.com/cve/CVE-2026-105134
• https://vuldb.com/submit/942743
• https://vuldb.com/vuln/413351
• https://vuldb.com/vuln/413351/cti
• https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
• https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• https://ltna.com.au/cyber

Indicators of Compromise

MITRE ATT&CK

• T1059 — Command and Scripting Interpreter
• T1505.003 — Web Shell
• T1496 — Resource Hijacking
• T1036.005 — Match Legitimate Resource Name or Location
• T1564 — Hide Artifacts
• T1543.003 — Windows Service
• T1608.001 — Upload Malware
• T1190 — Exploit Public-Facing Application
• T1036.004 — Masquerade Task or Service
• T1057 — Process Discovery
• T1059.001 — PowerShell
• T1571 — Non-Standard Port
• T1059.003 — Windows Command Shell
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1569.002 — Service Execution
• T1124 — System Time Discovery