VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 12:43 UTC

CVE-2026-105134

QueueJumper

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is p…

Read full description

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

6.0/10

REALITY · THREAT PRIORITY

8.9/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 10: +1.50
Fresh EPSS: 81.76%: +0.41

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 57 documents and public datasets.

Hype components

Headline sample (25%)

10/100

Press, 30 days (60%)

70/100

Grounded branding (15%)

100/100

HYPE TOTAL60/100

Sources and documents

Press · 16 Oct 2026, 07:00 · CISA KEV vulnerabilities: Four flaws under attack - NeoTeo

Press · 15 Oct 2026, 07:00 · Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134) - Bitdefender

Security Affairs

Press · 15 Oct 2026, 07:00 · U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known... - Security Affairs

The Hacker News

Press · 15 Oct 2026, 07:00 · AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - The Hacker News

Help Net Security

Press · 15 Oct 2026, 07:00 · CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products - Help Net Security

See all 57 source documents

CyberSecurityNews

Press · 12 Oct 2026, 07:00 · Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners - CyberSecurityNews

Press · 12 Oct 2026, 07:00 · AhsayCBS Backup Console Under Active Exploitation: CVE-2026-105133/105134 Chain Leads From Auth Bypass to RCE, and 10.3.4.0 Does Not Close It - Rescana

Press · 10 Oct 2026, 07:00 · AhsayCBS attacks reportedly targeted five organizations - NeoTeo

IT Security Guru

Press · 09 Oct 2026, 07:00 · Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners - IT Security Guru

Press · 09 Oct 2026, 07:00 · Unpatched AhsayCBS Vulnerabilities Exploited in the Wild - SecurityWeek

BleepingComputer

Press · 09 Oct 2026, 07:00 · Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto - BleepingComputer

The Hacker News

Press · 09 Oct 2026, 07:00 · Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge - The Hacker News

Press · 08 Oct 2026, 07:00 · Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer - SOCRadar

Press · 08 Oct 2026, 07:00 · Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer - Huntress

Press · 18 Sep 2026, 07:00 · Queue-jumper sparks chaos at Sydney Apple Store during iPhone 18 Pro launch - The Apple Post

Press · 04 Aug 2026, 07:00 · Rapidly Rising Risk: AI in the Shadows - Bitdefender

Press · 20 Jul 2026, 07:00 · #NSTviral: Opposite-lane shortcut backfires for queue jumper in Shah Alam - NST Online

Press · 14 May 2026, 07:00 · Bitdefender GravityZone: 100% Telemetry in AV-Comparatives 2026 EDR Test - Bitdefender

Press · 26 Apr 2026, 07:00 · 12 injured by queue-jumper at city petrol station - Bangkok Post

Press · 21 Apr 2026, 07:00 · A Cybersecurity Lifeline for Lean IT Teams: Introducing C.R.E.W. - Bitdefender

Press · 05 Apr 2026, 18:13 · Choose Your Weapon (Queue Jumper Grey) (2010) by Banksy - For Sale - Artsy

Press · 27 Feb 2026, 08:00 · AI in Cybersecurity: Is It Worth the Effort for Lean Security Teams? - Bitdefender

Press · 22 Dec 2025, 08:00 · Husband beaten to death by queue jumper - News.com.au

Press · 21 Dec 2025, 08:00 · Grieving widow claims 'no justice' after queue-jumper who killed husband could be out in three years - LBC

Press · 05 Nov 2025, 08:00 · Bring Every Signal Into Focus With GravityZone Security Data Lake - Bitdefender

Press · 15 Sep 2025, 07:00 · Bitdefender Achieves Unparalleled Testing Results in VBSpam Benchmark - Bitdefender

Press · 16 Feb 2025, 08:00 · Elite Sydney health club runs $30,000 queue-jumper special - AFR

Press · 06 Feb 2025, 08:00 · Shaping the Future of Cyber Defense at the Global Cybersecurity Camp - Bitdefender

Press · 12 Jan 2025, 08:00 · Why not give Sir New Prime Minister a break? | David Mitchell - The Guardian

Press · 19 Dec 2024, 08:00 · Hen party fight broke out at train station over toilet queue jumper - Metro.co.uk

Press · 10 Dec 2024, 02:49 · Half of Businesses Have Yet to Take Control of Password Security; Technology Sector Leads the Pack - Bitdefender

Press · 17 Nov 2024, 02:18 · Security Automation Cuts Breach Costs in Half, New Research Shows - Bitdefender

Press · 19 Jun 2024, 07:00 · Should Narrative Attacks Be a Concern for Businesses? - Bitdefender

Press · 06 Nov 2023, 08:00 · 'What kind of f***ing logic is this': Queue-jumper confronts driver after taking his parking lot in Bedok - AsiaOne.com

Press · 02 Aug 2023, 07:00 · MSMQ QueueJumper (RCE Vulnerability): An In-Depth Technical Analysis - IBM

Press · 28 Apr 2023, 07:00 · Trio Of Tags For Identifying Microsoft Message Queue Scanners And Exploiters Live Now - QueueJumper (CVE-2023-21554) - GreyNoise

Press · 13 Apr 2023, 07:00 · Microsoft April 2023 Patch Tuesday Highlights: everything you need to know - wiz.io

BleepingComputer

Press · 12 Apr 2023, 07:00 · Windows admins warned to patch critical MSMQ QueueJumper bug - BleepingComputer

Press · 12 Apr 2023, 07:00 · Technical Advisory: Unauthorized RCE Vulnerability in MSMQ Service CVE-2023-21554 aka QueueJumper - Bitdefender

Check Point Research

Press · 11 Apr 2023, 07:00 · QueueJumper: Critical Unauthorized RCE Vulnerability in MSMQ Service - Check Point Research

Manchester Evening News

Press · 10 Feb 2023, 08:00 · 'I will level you', taxi queue jumper said before hurling liquid on dad and girl - Manchester Evening News

Press · 19 Jul 2022, 07:00 · Join Bitdefender at Black Hat 2022 - Bitdefender

Press · 01 Mar 2022, 08:00 · Bitdefender Wins Three AV-TEST Awards - Bitdefender

Press · 22 Oct 2021, 07:00 · Suspended sentence for petrol station assault on queue jumper - Matangi Tonga

Press · 20 Apr 2021, 07:00 · Man punched in the face after challenging queue-jumper at convenience store - The Argus

When The Horn Blows

Press · 16 Jun 2020, 07:00 · Horsemeat - 'Queue Jumper' - When The Horn Blows

Press · 14 May 2020, 07:00 · Fake Zoom Phishing Campaign Targets Employees for their Office 365 Credentials - Bitdefender

Press · 27 Apr 2020, 07:00 · Coronavirus: Tesco 'queue jumper' who 'screamed at customers' tackled to ground by police - Yahoo News UK

Press · 17 Mar 2020, 07:00 · Bitdefender blocks CVE-2020-0796 ‘EternalDarkness Bug’ at Network Level - Bitdefender

Press · 18 Oct 2019, 07:00 · Few Companies Restrict Use of Unencrypted or Unsafe USB Drives - Bitdefender

Press · 18 Jul 2019, 07:00 · Festival-goers push over portable toilet with ‘queue jumper’ inside - New York Post

Press · 14 May 2019, 07:00 · FBI Detects New Surveillance Malware Linked to North Korea’s Lazarus Group - Bitdefender

Press · 15 Apr 2019, 07:00 · The Divine Comedy’s ‘Queuejumper’ Video Is A Joy - clashmusic.com

Press · 15 Apr 2019, 07:00 · The Divine Comedy - Queuejumper - YouTube

"CVE-2026-105134" - Google News

Press · 12 Dec 2018, 08:00 · How to Avoid Becoming the Next Equifax – Investigation Reveals Breach Was ‘Entirely Preventable’ - Bitdefender

"CVE-2026-105134" - Google News

Press · 12 Jul 2017, 07:00 · Firms that didn’t patch and enabled local admin rights continue to suffer post cyber-attack - Bitdefender

The Independent

Press · 31 May 2016, 07:00 · Pickpocket caught on CCTV robbing an unsuspecting queue-jumper - The Independent

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

━ Hype Score (Perceived) ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 10; EPSS 81.8%
Attention, last 30 days: 12 distinct story titles; 12 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:51.107056+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

31 May 2016, 07:00

Published

04 Oct 2026, 05:30

Added to the CISA KEV catalog

14 Oct 2026, 00:00

Latest press mention

16 Oct 2026, 07:00

Score calculated

05 Nov 2026, 13:59

Name

QueueJumper