EUVD-2026-92078
GHSA-mxj3-2x8q-2rh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AhsayCBS Replication Receiver endpoint
-
DeliverySend crafted POST to UpdateReceivers.do
-
ExploitInject shell command via 'random' parameter
-
ExecutionExecute arbitrary OS commands on server
-
ImpactFull host and backup-data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the AhsayCBS Replication Receiver component, specifically the /rps/api/json/UpdateReceivers.do API endpoint, which must be reachable by the attacker. No authentication is required per the CVSS vector (PR:N), no user interaction is needed (UI:N), and the flaw is triggered by manipulating the 'random' argument with shell metacharacters. The primary limiting factor is exposure: the Replication Receiver API must be deployed and network-accessible (this feature is used in replication/high-availability configurations), and the instance must be running an affected version (10.3.0 through 10.3.2); upgrading to 10.3.4 removes the condition. |
| Impact | This is a genuinely high-priority flaw, though signal confidence is limited by single-source reporting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable OS command injection (CWE-78) with full confidentiality, integrity, and availability impact - a near-worst-case profile for a server product. The 'E:P' (Proof-of-Concept) exploit-maturity metric aligns with the description's statement that an exploit 'has been published,' so publicly available exploit code exists. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so active in-the-wild exploitation is NOT confirmed and widespread automated exploitation cannot be quantified. The absence of EPSS/KEV does not lower the intrinsic risk but means the signals are intrinsic-severity-driven rather than evidence-of-exploitation-driven. One data caveat: the input 4.0 vector asserts subsequent-system impact (SC:H/SI:H/SA:H), which is not supported by the description (a single-host command injection); this appears inflated and should be verified. All reporting traces to a single source (VulDB), so independent corroboration is thin. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to the /rps/api/json/UpdateReceivers.do endpoint of the AhsayCBS Replication Receiver, injecting shell metacharacters into the 'random' argument to execute arbitrary OS commands on the backup server. Because published exploit code exists and no authentication is required (PR:N, AC:L), the attack is straightforward to reproduce and can yield full server compromise, including access to backed-up customer data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 04, 2026
Unauthenticated OS command injection in Ahsay AhsayCBS (versions 10.3.0 through 10.3.2) allows a remote attacker to execute arbitrary operating system commands on the backup server by supplying crafted shell metacharacters in the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are required, and both the CVSS v4.0 score of 9.3 and the independently assessed CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicate full confidentiality, integrity, and availability impact on the host. Publicly available exploit code exists (E:P) and the flaw is described as published and usable, though there is no CISA KEV confirmation of active exploitation at time of analysis; reporting originates from a single source (VulDB), so corroboration is limited. A vendor patch is available: upgrading to AhsayCBS 10.3.4 resolves the issue.
Earlier versions of this analysis (1)
Unauthenticated remote OS command injection in Ahsay AhsayCBS versions up to and including 10.3.2 lets a network-positioned attacker execute arbitrary operating-system commands on the server by manipulating the 'random' argument of /rps/api/json/UpdateReceivers.do in the Replication Receiver component. The flaw carries the maximum CVSS v4.0 base score of 10.0 (and an independent CVSS v3.1 assessment of 10.0: AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), requiring no authentication, user interaction, or non-default configuration beyond the replication/management interface being reachable. Publicly available exploit code exists for this issue (the CVSS v4.0 vector encodes E:P), and the vendor has released version 10.3.4 to remediate it.
RemediationAI
Vendor-released patch: upgrade AhsayCBS to version 10.3.4, as documented in the vendor release notes at https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4; because the flaw is reachable without credentials, this upgrade should be treated as urgent for any instance running 10.3.0 through 10.3.2 with the Replication Receiver enabled. If immediate patching is not possible, restrict network access to /rps/api/json/UpdateReceivers.do at the firewall, reverse proxy, or WAF so that only trusted replication peers can reach it - accepting that this will break legitimate replication traffic from unlisted sources until the allow-list is tuned. Where the Replication Receiver feature is not required, disable or unbind it entirely; the trade-off is loss of replication/high-availability functionality. As a temporary WAF or proxy rule, reject requests to that endpoint whose 'random' parameter contains shell metacharacters (; | & $ ` > < newlines), but treat this as a stopgap only, since command-injection filtering is routinely bypassed by encoding and alternate payloads. Post-patching, audit AhsayCBS hosts for signs of command execution in the context of the service account and review stored backup data for tampering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is AhsayCBS's Replication Receiver, exposed through the web API path /rps/api/json/UpdateReceivers.do - an endpoint whose '.do' suffix and JSON API structure indicate a Java servlet/Struts-style web application tier typical of Ahsay's backup server platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the value of the 'random' request parameter is passed into a shell invocation without adequate escaping or allow-listing, so injected metacharacters are interpreted by the underlying OS shell rather than treated as data. Because the flaw sits in the request-handling layer of an internet-reachable API rather than in a privileged local function, it yields remote code execution in the context of the AhsayCBS service account, which on backup appliances typically has broad read/write access to stored backup data and configuration. The CPE record cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:* is an unbounded wildcard, while EUVD explicitly enumerates 10.3.0, 10.3.1 and 10.3.2 as the affected releases, with 10.3.4 identified as the fixed version and 10.3.3 not cited in the supplied data.
Know when Ahsaycbs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated remote command injection via an exposed API parameter gives AV:N/AC:L/PR:N/UI:N with full C/I/A; scope unchanged (S:U) as code executes within the host's own context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Articles & Coverage 1
Technical POC Analysis
CWE-78 OS command injection in the AhsayCBS web application.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
AhsayCBS backup servers running versions 10.3.0 through 10.3.2 are exposed to a critical unauthenticated remote command execution vulnerability; publicly available exploit code exists, and a vendor-released patch is available in 10.3.4. A compromise could allow an attacker to take full control of backup infrastructure, exposing sensitive data, enabling tampering with backups, and disrupting recovery operations. Leadership should prioritize immediate patching and exposure reduction because backup systems are high-value targets and often trusted across the environment.
Apply vendor patch.
Threat Model
3 threats: Elevation of Privilege, Tampering, Information Disclosure
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB