CVE-2026-105134

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

State: Published
Severity: 10.0 Critical
Published: Oct 4, 2026
Updated: Oct 26, 2026
Reserved: Oct 3, 2026

Description

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A	VulDB
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C	VulDB
3.0	10.0 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C	VulDB
2.0	10.0 High	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
AhsayCBSAhsay	9.15.2.0Affected 9.15.2.1Affected 9.15.2.2Affected 9.15.2.3Affected 9.15.2.4Affected 9.15.2.5Affected 9.15.2.6Affected 9.15.2.7Affected 9.15.2.8Affected 9.15.2.9Affected 9.15.2.10Affected 9.15.2.11Affected 9.15.2.12Affected 9.15.2.13Affected 9.15.2.14Affected 9.15.2.15Affected 9.15.2.16Affected 9.15.2.17Affected 9.15.2.18Affected 9.15.2.19Affected 9.15.2.20Affected 9.15.2.21Affected 9.15.2.22Affected 9.15.2.23Affected 9.15.2.24Affected and 92 more versions

Product

Versions

AhsayCBSAhsay

9.15.2.0Affected
9.15.2.1Affected
9.15.2.2Affected
9.15.2.3Affected
9.15.2.4Affected
9.15.2.5Affected
9.15.2.6Affected
9.15.2.7Affected
9.15.2.8Affected
9.15.2.9Affected
9.15.2.10Affected
9.15.2.11Affected
9.15.2.12Affected
9.15.2.13Affected
9.15.2.14Affected
9.15.2.15Affected
9.15.2.16Affected
9.15.2.17Affected
9.15.2.18Affected
9.15.2.19Affected
9.15.2.20Affected
9.15.2.21Affected
9.15.2.22Affected
9.15.2.23Affected
9.15.2.24Affected
and 92 more versions

References

VDB-413351 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionvdb-entrytechnical-description
VDB-413351 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-105134 | CVE Analysis and Reportthird-party-advisory
Submit #942743 | Ahsay Systems Corporation Limited Ahsay CBS 10.3.0 Remote Code Execution via Arbitrary File Writethird-party-advisory
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-updatepatch
https://www.huntress.com/blog/ahsaycbs-flaws-exploitbroken-linkexploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.