Remote command injection via Replication Receiver endpoint

Ahsay · AhsayCBS

Updated October 17, 2026

SeverityCritical

IT Intelligence Analysis

AhsayCBS’s `/rps/api/json/UpdateReceivers.do` endpoint fails to validate the random parameter, allowing an unauthenticated attacker to inject OS commands. The flaw can be chained with CVE‑2026‑105133 to bypass authentication entirely.

Impact if Unpatched

Successful exploitation grants arbitrary code execution on the backup server, enabling ransomware deployment, data exfiltration, or destruction of backup archives.

Remediation Steps

Apply the security update released by Ahsay; if immediate patching is unavailable, block external access to the `/rps/api/json/` path via firewall rules and monitor logs for unusual parameter values.

More active vulnerabilities

CriticalCVE-2026-102764Remote attacker can bypass authentication and manipulate files HighCVE-2025-61624Authenticated admin can traverse paths to overwrite system files HighCVE-2026-21589Unauthenticated actors can retrieve files from Atlassian web roots CriticalCVE-2026-76519Unauthenticated attacker can write files via relative path traversal